Windows Registry: New BgInfo UserFields value enabling custom VBScript execution

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags the creation or update of a registry value under the BgInfo UserFields path used by BgInfo configuration. Attackers can abuse this mechanism to have BgInfo.exe load attacker-controlled VBScript logic. The detection relies on registry set telemetry matching the TargetObject path and a Details value that begins with '4' (WMI-related).

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Suspicious Loopback Proxy Server Configured via Registry (via registry_set)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

Malicious Gh0stBins RAT Registry Marker HHClient

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

Windows Registry: New BgInfo UserFields value enabling custom VBScript execution

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-new-bginfo-userfields-value-enabling-custom-vbscript-execution-992dd79f

title: "Windows Registry: New BgInfo UserFields value enabling custom VBScript execution"
id: 9f7c845a-cbe3-45f9-86fe-c06ab6d7fdc5
related:
  - id: cd277474-5c52-4423-a52b-ac2d7969902f
    type: similar
  - id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3
    type: derived
status: test
description: This rule flags the creation or update of a registry value under the BgInfo UserFields path used by BgInfo configuration. Attackers can abuse this mechanism to have BgInfo.exe load attacker-controlled VBScript logic. The detection relies on registry set telemetry matching the TargetObject path and a Details value that begins with '4' (WMI-related).
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-16
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Winternals\BGInfo\UserFields\
    Details|startswith: "4"
  condition: selection
falsepositives:
  - Legitimate VBScript
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL