BGInfo.exe Abuse - Scripting Engine Spawn or Non-Standard .bgi Config
This rule detects potentially malicious usage of the BGInfo.exe utility, a legitimate Sysinternals tool used for desktop configuration information. The detection focuses on two primary attack vectors: 1) BGInfo.exe spawning scripting interpreters like wscript.exe or cscript.exe, which is anomalous behavior for a configuration tool; and 2) Execution of BGInfo.exe with a .bgi configuration file located in non-standard, potentially user-writable, or temporary directories, indicating potential abuse of the configuration file to execute arbitrary payloads.
SentinelOne
