BaaUpdate.exe Suspicious DLL Load from Writable Location

SigmaHQ Detections@sigmaHQ

•updated Oct 18, 2025•1•0•22

Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious, publicly writable locations. This activity could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking, abusing the BDEUILauncher Class to execute code in the logged-on user's session without credential theft.