Pay2Key BitLocker Suspension via PowerShell ExecutionPolicy Bypass

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•1

Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.