Suspicious Bitlocker Encryption

Description

Looks for potential instances of bitlocker modifying registry settings to allow encryption, where it's executed via a .bat file.

Query · kql

DeviceProcessEvents
| where FileName =~ "reg.exe" 
// Search for BitLocker encryption being enabled without the chip
    and ProcessCommandLine has "EnableBDEWithNoTPM"
    // Using contains due to variant forms of capturing 1: 1, 0x1
    and (ProcessCommandLine has "true" or ProcessCommandLine contains "1")
// Search for this activity being launched by batch scripts, typically as: C:\Windows\[name].bat
| where InitiatingProcessCommandLine has_all (@"C:\Windows\", ".bat")
Raw source Suspicious Bitlocker Encryption · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 476c9326-c53d-495c-8a54-c304a43cb446
name: Suspicious Bitlocker Encryption
description: |
  Looks for potential instances of bitlocker modifying registry settings to allow encryption, where it's executed via a .bat file.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Ransomware
query: |
  DeviceProcessEvents
  | where FileName =~ "reg.exe" 
  // Search for BitLocker encryption being enabled without the chip
      and ProcessCommandLine has "EnableBDEWithNoTPM"
      // Using contains due to variant forms of capturing 1: 1, 0x1
      and (ProcessCommandLine has "true" or ProcessCommandLine contains "1")
  // Search for this activity being launched by batch scripts, typically as: C:\Windows\[name].bat
  | where InitiatingProcessCommandLine has_all (@"C:\Windows\", ".bat")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.