Query: rule covering Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. Th
Matching passage: Sigma rule: Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. Th. Logsource: windows / process_creation. Rule: title: BitLockerTogo.EXE Execution id: 7f2376f9-42ee-4dfc-9360-fecff9a88fc8 status: test description: 'Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing. ' references: - https://tria.ge/240521-ynezpagf56/behavioral1 - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091 - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/ - https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/ author: Josh Nickels, mttaggart date: 2024-07-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \BitLockerToGo.exe condition: selection falsepositives: - Legitimate usage of BitLockerToGo.exe to encrypt portable devices. level: low
Near-miss passage: Sigma rule: Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or. Logsource: windows / registry_event. Rule: title: Windows Defender Threat Severity Default Action Modified id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f related: - id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e type: similar status: experimental description: 'Detects modifications or creations of Windows Defender''s default threat action settings based on severity to ''allow'' or take ''no action''. This is a highly suspicious configuration change that effectively disables Defender''s ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads. ' references: - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: Matt Anderson (Huntress) date: 2025-07-11 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction\ TargetObject|endswith: - \1 - \2 - \4 - \5 Details: - DWORD (0x00000006) - DWORD (0x00000009) condition: selection falsepositives: - Legitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity. - Software installations that legitimately modify Defender settings (less common for these specific keys). level: high