Detectionmediumtest

New BgInfo.EXE Custom DB Path Registry Configuration

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Wed Aug 1653330955-dc52-487f-a3a2-da24dcff99b5windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|endswith: '\Software\Winternals\BGInfo\Database'
    condition: selection

False Positives

Legitimate use of external DB to save the results

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0005 · Defense Evasion

Techniques

T1112 · Modify Registry

Rule Metadata

Rule ID

53330955-dc52-487f-a3a2-da24dcff99b5

Status

test

Level

medium

Type

Detection

Created

Wed Aug 16

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/registry/registry_set/registry_set_bginfo_custom_db.yml

Raw Tags

attack.persistenceattack.defense-evasionattack.t1112

View on GitHub