Uncommon Child Process Of BgInfo.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects uncommon child processes spawned by 'BgInfo.exe' or 'BgInfo64.exe'. This behavior can indicate an adversary abusing BgInfo, a legitimate Microsoft utility, to proxy execution of malicious code, potentially via external VBScript, as part of defense evasion or execution tactics.