Pay2Key BitLocker Suspension via PowerShell ExecutionPolicy Bypass

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of PowerShell with the '-ExecutionPolicy Bypass' flag to interact with BitLocker-related cmdlets (Suspend-BitLocker or Get-BitLockerVolume). This pattern is often associated with adversary attempts to weaken or assess disk encryption protections, a technique commonly used by ransomware actors.