1type: trigger
2name: sigmahq/proc_creation_win_bginfo_suspicious_child_process
3description: |
4  Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.ParentImage endsWith '\\bginfo.exe' || evt.Parsed.ParentImage endsWith '\\bginfo64.exe') && (evt.Parsed.Image endsWith '\\calc.exe' || evt.Parsed.Image endsWith '\\cmd.exe' || evt.Parsed.Image endsWith '\\cscript.exe' || evt.Parsed.Image endsWith '\\mshta.exe' || evt.Parsed.Image endsWith '\\notepad.exe' || evt.Parsed.Image endsWith '\\powershell.exe' || evt.Parsed.Image endsWith '\\pwsh.exe' || evt.Parsed.Image endsWith '\\wscript.exe' || evt.Parsed.Image contains '\\AppData\\Local\\' || evt.Parsed.Image contains '\\AppData\\Roaming\\' || evt.Parsed.Image contains ':\\Users\\Public\\' || evt.Parsed.Image contains ':\\Temp\\' || evt.Parsed.Image contains ':\\Windows\\Temp\\' || evt.Parsed.Image contains ':\\PerfLogs\\'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1059.005
15   - attack.t1218
16   - attack.t1202
17
18  label: "Suspicious Child Process Of BgInfo.EXE"
19  behavior : "windows:audit"
20  remediation: false
21
22scope:
23  type: ParentProcessId
24  expression: evt.Parsed.ParentProcessId
25
26