Uncommon Child Process Spawned by Bginfo.exe on Windows

title: Uncommon Child Process Spawned by Bginfo.exe on Windows
id: efb7227c-5ac9-4771-abb9-0c6ee42b6005
related:
  - id: 811f459f-9231-45d4-959a-0266c6311987
    type: similar
  - id: aaf46cdc-934e-4284-b329-34aa701e3771
    type: derived
status: test
description: Identifies process creations where the parent executable is Bginfo.exe or Bginfo64.exe and the spawned child process is uncommon. Attackers may abuse Bginfo to proxy execution, helping them run external commands in a way that can evade simplistic monitoring. The rule relies on Windows process creation telemetry, specifically the parent image path matching Bginfo.exe/ Bginfo64.exe.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-26
modified: 2023-08-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \bginfo.exe
      - \bginfo64.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1