New BgInfo.EXE Custom DB Path Registry Configuration
Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.
Detection logic
Detection requirements
- Platform
- Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- windows
- Log source category
- registry_set
Known benign triggers
- Legitimate use of external DB to save the results
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 53330955-dc52-487f-a3a2-da24dcff99b5
- Tagged by the source as
- attack.defense-impairmentattack.persistence
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Published
- Aug 26, 2026
- Version
- 1