Pay2Key BitLocker Suspension via PowerShell ExecutionPolicy Bypass
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
YARA-L
