Suspicious BitLocker Registry Modification via Reg.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•24

Detects suspicious modifications to BitLocker-related registry keys using the `reg.exe` utility. Adversaries may modify these keys to enable or disable BitLocker, potentially as a precursor to data encryption for impact (ransomware) or to facilitate data exfiltration by disabling encryption.