Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.

FreeUnreviewedSigmahighv1

windows-reg-exe-adds-bitlocker-policy-registry-values-0e0255bf

title: "Windows: reg.exe Adds BitLocker Policy Registry Values"
id: 107a197a-1d46-4891-8e95-285851034632
status: test
description: This rule identifies suspicious use of reg.exe to add BitLocker-related policy registry values under SOFTWARE\Policies\Microsoft\FVE. Attackers may attempt to weaken BitLocker protections or alter startup and recovery configuration by writing specific policy fields. Detection relies on Windows process creation telemetry capturing the command line arguments passed to reg.exe.
references:
  - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_bitlocker.yml
author: frack113, Huntrule Team
date: 2021-11-15
modified: 2022-09-09
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - REG
      - ADD
      - \SOFTWARE\Policies\Microsoft\FVE
      - /v
      - /f
    CommandLine|contains:
      - EnableBDEWithNoTPM
      - UseAdvancedStartup
      - UseTPM
      - UseTPMKey
      - UseTPMKeyPIN
      - RecoveryKeyMessageSource
      - UseTPMPIN
      - RecoveryKeyMessage
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0e0255bf-2548-47b8-9582-c0955c9283f5
    type: derived

What it detects

This rule identifies suspicious use of reg.exe to add BitLocker-related policy registry values under SOFTWARE\Policies\Microsoft\FVE. Attackers may attempt to weaken BitLocker protections or alter startup and recovery configuration by writing specific policy fields. Detection relies on Windows process creation telemetry capturing the command line arguments passed to reg.exe.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.