BitLockerTogo.EXE Execution

calendar Aug 12, 2024 · attack.defense-evasion attack.t1218  ·
Share on: linkedin copy

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

Sigma rule (View on GitHub)

 1title: BitLockerTogo.EXE Execution
 2id: 7f2376f9-42ee-4dfc-9360-fecff9a88fc8
 3status: experimental
 4description: |
 5    Detects the execution of "BitLockerToGo.EXE".
 6    BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
 7    This is a rarely used application and usage of it at all is worth investigating.
 8    Malware such as Lumma stealer has been seen using this process as a target for process hollowing.    
 9references:
10    - https://tria.ge/240521-ynezpagf56/behavioral1
11    - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091
12    - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/
13    - https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/
14author: Josh Nickels, mttaggart
15date: 2024-07-11
16tags:
17    - attack.defense-evasion
18    - attack.t1218
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection:
24        Image|endswith: '\BitLockerToGo.exe'
25    condition: selection
26falsepositives:
27    - Legitimate usage of BitLockerToGo.exe to encrypt portable devices.
28level: low

References

Related rules

to-top