Suspicious BitLocker Access Agent Update Utility Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.