New BgInfo.EXE Custom DB Path Registry Configuration

Hunt Hypothesis

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate

Detection Rule

Sigma (Original)

title: New BgInfo.EXE Custom DB Path Registry Configuration
id: 53330955-dc52-487f-a3a2-da24dcff99b5
status: test
description: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-16
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\Winternals\BGInfo\Database'
    condition: selection
falsepositives:
    - Legitimate use of external DB to save the results
level: medium

KQL (Azure Sentinel)

imRegistry
| where RegistryKey endswith "\\Software\\Winternals\\BGInfo\\Database"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where RegistryKey endswith "\\Software\\Winternals\\BGInfo\\Database"

Required Data Sources

False Positive Guidance

• Legitimate use of external DB to save the results

MITRE ATT&CK Context

• Tactic: Persistence
• Technique: T1112 — T1112

References

• Internal Research
• SigmaHQ Rule