New BgInfo.EXE Custom DB Path Registry Configuration — Detection Rule

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Read the full analysis on IntelFusions