Suspicious BitLocker Access Agent Update Utility Spawning System Utilities

SigmaHQ Detections@sigmaHQ

•updated Oct 18, 2025•1•0•18

Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.