New BgInfo.EXE Custom DB Path Registry Configuration
Detects the modification or creation of the 'Database' registry value under 'Software\Winternals\BGInfo' which can be used by attackers to specify an external database path for BgInfo. This could be leveraged to exfiltrate information collected by BgInfo by directing it to a controlled location.
Sigma
