New BgInfo.EXE Custom VBScript Registry Configuration

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the modification of a registry value related to BgInfo configuration, specifically within the 'UserFields' subkey, where the 'Details' field starts with '4' (indicating a WMI script). This modification can be abused to execute custom VBScript via 'BgInfo.exe', potentially leading to persistence or defense evasion.