BitLocker feature configuration (Reg via command)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker configures BitLocker for ransomware purposes.

Known false positives

Initial BitLocker configuration via GPO

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: BitLocker feature configuration (Reg via command)
description: Detects scenarios where an attacker configures BitLocker for ransomware purposes.
references:
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
- https://admx.help/?Category=MDOP&Policy=Microsoft.Policies.BitLockerManagement::BMSOSDEncryptionPolicy
- https://www.bleepingcomputer.com/news/microsoft/microsoft-iranian-hackers-encrypt-windows-systems-using-bitlocker/
tags:
- attack.impact
- attack.t1486
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: \reg.exe
    CommandLine|contains|all: # Full command: "REG  ADD HKLM\SOFTWARE\Policies\Microsoft\FVE /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f"
      - REG ADD
      - '\SOFTWARE\Policies\Microsoft\FVE'
    CommandLine|contains:
      - UseTPM
      - UseTPMKey
      - UseTPMPIN
      - UseTPMKeyPIN
      - RecoveryKeyMessage
      - EnableBDEWithNoTPM
      - UseAdvancedStartup
      - RecoveryKeyMessageSource
  condition: selection
falsepositives:
- Initial BitLocker configuration via GPO
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  NewProcessName|endswith: \reg.exe
  CommandLine|contains|all:
    - REG ADD
    - '\SOFTWARE\Policies\Microsoft\FVE'
  CommandLine|contains:
    - UseTPM
    - UseTPMKey
    - UseTPMPIN
    - UseTPMKeyPIN
    - RecoveryKeyMessage
    - EnableBDEWithNoTPM
    - UseAdvancedStartup
    - RecoveryKeyMessageSource

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`EnableBDEWithNoTPM` corpus 3 (sigma 2, kusto 1) `REG ADD` corpus 14 (sigma 13, kusto 1) `RecoveryKeyMessage` corpus 3 (sigma 2, kusto 1) `RecoveryKeyMessageSource` corpus 3 (sigma 2, kusto 1) `UseAdvancedStartup` corpus 3 (sigma 2, kusto 1) `UseTPM` corpus 2 (sigma 2) `UseTPMKey` corpus 3 (sigma 2, kusto 1) `UseTPMKeyPIN` corpus 3 (sigma 2, kusto 1) `UseTPMPIN` corpus 2 (sigma 2) `\SOFTWARE\Policies\Microsoft\FVE` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`

BitLocker feature configuration (Reg via command)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`