mdecrevoisier high experimental sigma

BitLocker feature configuration (Reg via command)

Detects scenarios where an attacker configures BitLocker for ransomware purposes.

View Source

Detection Logic

{
  "selection": {
    "NewProcessName
| endswith": "\\reg.exe",
    "CommandLine
| contains
| all": [
      "REG ADD",
      "\\SOFTWARE\\Policies\\Microsoft\\FVE"
    ],
    "CommandLine
| contains": [
      "UseTPM",
      "UseTPMKey",
      "UseTPMPIN",
      "UseTPMKeyPIN",
      "RecoveryKeyMessage",
      "EnableBDEWithNoTPM",
      "UseAdvancedStartup",
      "RecoveryKeyMessageSource"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Initial BitLocker configuration via GPO

Field Validations

Loading…

Comments (0)

Loading comments...