Windows Process Creation: BitLockerToGo.exe Execution

Alerts on Windows execution of BitLockerToGo.exe, a rarely used BitLocker To Go component for portable drive encryption.

FreeUnreviewedSigmalowv1

windows-process-creation-bitlockertogo-exe-execution-7f2376f9

title: "Windows Process Creation: BitLockerToGo.exe Execution"
id: bc75b85f-1712-4b91-b304-68ea5057eb12
status: test
description: This rule flags process creation events where the executable name ends with \BitLockerToGo.exe, indicating BitLocker To Go has been launched. Because it is an uncommon encryption utility for portable media, unexpected execution can signal attacker preparation or abuse of legitimate tooling. Detection relies on Windows process creation telemetry that includes the process image path.
references:
  - https://tria.ge/240521-ynezpagf56/behavioral1
  - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091
  - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/
  - https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml
author: Josh Nickels, mttaggart, Huntrule Team
date: 2024-07-11
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \BitLockerToGo.exe
  condition: selection
falsepositives:
  - Legitimate usage of BitLockerToGo.exe to encrypt portable devices.
level: low
license: DRL-1.1
related:
  - id: 7f2376f9-42ee-4dfc-9360-fecff9a88fc8
    type: derived

What it detects

This rule flags process creation events where the executable name ends with \BitLockerToGo.exe, indicating BitLocker To Go has been launched. Because it is an uncommon encryption utility for portable media, unexpected execution can signal attacker preparation or abuse of legitimate tooling. Detection relies on Windows process creation telemetry that includes the process image path.

Known false positives

Legitimate usage of BitLockerToGo.exe to encrypt portable devices.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.