Pay2Key BitLocker Suspension via PowerShell ExecutionPolicy Bypass

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects execution of PowerShell commands that use the ExecutionPolicy Bypass flag while concurrently attempting to suspend BitLocker protection. This behavior is highly characteristic of ransomware activity, specifically associated with the ShrinkLocker malware, where the adversary disables disk encryption protection to facilitate malicious operations or subsequent encryption.