1200KM / sigma-rule
New BgInfo.EXE Custom WMI Query Registry Configuration — Sigma Rule
Sigma rule cd277474-5c52-4423-a52b-ac2d7969902f. New BgInfo.EXE Custom WMI Query Registry Configuration — Sigma Rule. Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"
Rule metadata and linked tags
Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2023-08-16 / not supplied.
{
"category": "registry_set",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 736ffd8c3e44ebf119da3ebf649626ee2e8fd63d54148c6a662d4827dc7689c6
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: New BgInfo.EXE Custom WMI Query Registry Configuration
id: cd277474-5c52-4423-a52b-ac2d7969902f
related:
- id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3
type: similar
status: test
description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"
references:
- Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-16
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: '\Software\Winternals\BGInfo\UserFields\'
Details|startswith: '6' # WMI
condition: selection
falsepositives:
- Legitimate WMI query
level: medium
False positives
- Legitimate WMI query
Source references
- Internal Research (source note; no public URL supplied)
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.