Query: write Sigma for Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly w
Matching passage: Sigma rule: Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly w. Logsource: windows / image_load. Rule: title: BaaUpdate.exe Suspicious DLL Load id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 related: - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 type: similar status: experimental description: 'Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user''s session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user''s context without needing to steal credentials or use additional techniques to compromise the account. ' references: - https://github.com/rtecCyberSec/BitlockMove author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \BaaUpdate.exe ImageLoaded|endswith: .dll ImageLoaded|contains: - :\Perflogs\ - :\Users\Default\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \Contacts\ - \Favorites\ - \Favourites\ - \Links\ - \Music\ - \Pictures\ - \ProgramData\ - \Temporary Internet - \Videos\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate pote. Logsource: windows / file_event. Rule: title: Uncommon File Created by Notepad++ Updater Gup.EXE id: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 status: experimental description: 'Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files. ' references: - https://notepad-plus-plus.org/news/v889-released/ - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ - https://securelist.com/notepad-supply-chain-attack/118708/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-02-03 modified: 2026-03-16 tags: - attack.collection - attack.credential-access - attack.t1195.002 - attack.initial-access - attack.t1557 logsource: category: file_event product: windows detection: selection: Image|endswith: \gup.exe filter_main_legit_paths: TargetFilename|startswith: - C:\Program Files\Notepad++\ - C:\Program Files (x86)\Notepad++\ filter_main_temp_update_installer: TargetFilename|startswith: C:\Users\ TargetFilename|contains|all: - \AppData\Local\Temp\ - npp. - .Installer. - .exe filter_main_temp_generic_zip: TargetFilename|startswith: C:\Users\ TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip filter_main_recycle_bin: TargetFilename|startswith: C:\$Recycle.Bin\S-1-5-21 filter_main_plugins: - TargetFilename|contains: - \plugins\JsonTools\testfiles\ - \Notepad++\plugins\ComparePlugin\ - TargetFilename|contains|all: - npp. - .portable. - \plugins\ condition: selection and not 1 of filter_main_* falsepositives: - Custom or portable Notepad++ installations in non-standard directories. - Legitimate update processes creating temporary files in unexpected locations. level: high