New BgInfo.EXE Custom DB Path Registry Configuration
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND OBJECTNAME endswith "\Software\Winternals\BGInfo\Database" OR (OBJECTNAME endswith "\Software\Winternals\BGInfo" AND OBJECTVALUENAME = "Database") select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
