Windows: Uncommon Child Processes Spawned by Bginfo.exe

Flags unusual processes launched by Bginfo.exe/ Bginfo64.exe that may indicate abused proxy execution.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-26
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies process creation events where the parent process is BgInfo.exe or BgInfo64.exe and the spawned child process is considered uncommon. Attackers may use BgInfo as a proxy to execute additional payloads or tooling under a trusted-looking parent. The rule relies on Windows process creation telemetry, specifically the parent image path and the resulting child process creation.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows: Suspicious Child Process Spawned by VsCode code.exe

Windows WSL Process Spawning Uncommon Child Executables

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Windows: Uncommon Child Processes Spawned by Bginfo.exe

Pivot detection · T1202 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

uncommon-child-process-spawned-by-bginfo-exe-on-windows-aaf46cdc

title: "Windows: Uncommon Child Processes Spawned by Bginfo.exe"
id: efb7227c-5ac9-4771-abb9-0c6ee42b6005
related:
  - id: 811f459f-9231-45d4-959a-0266c6311987
    type: similar
  - id: aaf46cdc-934e-4284-b329-34aa701e3771
    type: derived
status: test
description: Identifies process creation events where the parent process is BgInfo.exe or BgInfo64.exe and the spawned child process is considered uncommon. Attackers may use BgInfo as a proxy to execute additional payloads or tooling under a trusted-looking parent. The rule relies on Windows process creation telemetry, specifically the parent image path and the resulting child process creation.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-26
modified: 2023-08-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \bginfo.exe
      - \bginfo64.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL