Hide Navigation Hide TOC

Suspicious Child Process Of BgInfo.EXE (811f459f-9231-45d4-959a-0266c6311987)

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Suspicious Child Process Of BgInfo.EXE (811f459f-9231-45d4-959a-0266c6311987)	Sigma-Rules	Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e)	Attack Pattern	1
Suspicious Child Process Of BgInfo.EXE (811f459f-9231-45d4-959a-0266c6311987)	Sigma-Rules	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	1
Suspicious Child Process Of BgInfo.EXE (811f459f-9231-45d4-959a-0266c6311987)	Sigma-Rules	Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	1
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2