Skip to content

Hide Navigation Hide TOC

Uncommon Child Process Of BgInfo.EXE (aaf46cdc-934e-4284-b329-34aa701e3771)

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Cluster A Galaxy A Cluster B Galaxy B Level
Uncommon Child Process Of BgInfo.EXE (aaf46cdc-934e-4284-b329-34aa701e3771) Sigma-Rules Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e) Attack Pattern 1
Uncommon Child Process Of BgInfo.EXE (aaf46cdc-934e-4284-b329-34aa701e3771) Sigma-Rules System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern 1
Uncommon Child Process Of BgInfo.EXE (aaf46cdc-934e-4284-b329-34aa701e3771) Sigma-Rules Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern 1
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2