Suspicious Child Process Of BgInfo.EXE — Detection Rule

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Read the full analysis on IntelFusions