Pay2Key BitLocker Suspension via PowerShell ExecutionPolicy Bypass

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the execution of PowerShell commands intended to suspend BitLocker encryption. Adversaries may attempt to disable or suspend disk encryption to facilitate data exfiltration or to modify protected system files.