Suspicious Child Process Of BgInfo.EXE

Title: Suspicious Child Process Of BgInfo.EXE
Status: test
Description:Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  -https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-16
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.005'
• -'attack.t1218'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_parent:
    ParentImage|endswith:
      -'\bginfo.exe'
      -'\bginfo64.exe'

  selection_child:
    - Image|endswith:
      - '\calc.exe'
      - '\cmd.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\notepad.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
    - Image|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - ':\Users\Public\'
      - ':\Temp\'
      - ':\Windows\Temp\'
      - ':\PerfLogs\'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high