huntrule

Windows Registry: New BgInfo UserFields value enabling custom VBScript execution

Detects registry changes under BgInfo UserFields that can be configured to run custom VBScript via BgInfo.exe.

FreeUnreviewedSigmamediumv1
title: "Windows Registry: New BgInfo UserFields value enabling custom VBScript execution"
id: 9f7c845a-cbe3-45f9-86fe-c06ab6d7fdc5
related:
  - id: cd277474-5c52-4423-a52b-ac2d7969902f
    type: similar
  - id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3
    type: derived
status: test
description: This rule flags the creation or update of a registry value under the BgInfo UserFields path used by BgInfo configuration. Attackers can abuse this mechanism to have BgInfo.exe load attacker-controlled VBScript logic. The detection relies on registry set telemetry matching the TargetObject path and a Details value that begins with '4' (WMI-related).
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-16
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Winternals\BGInfo\UserFields\
    Details|startswith: "4"
  condition: selection
falsepositives:
  - Legitimate VBScript
level: medium
license: DRL-1.1

What it detects

This rule flags the creation or update of a registry value under the BgInfo UserFields path used by BgInfo configuration. Attackers can abuse this mechanism to have BgInfo.exe load attacker-controlled VBScript logic. The detection relies on registry set telemetry matching the TargetObject path and a Details value that begins with '4' (WMI-related).

Known false positives

  • Legitimate VBScript

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.