I was wondering if anyone has thought about a scenario in which BitLocker can be used as ransomware.

For example, if the hacker was granted access to the system, and used BitLocker to encrypt the disk.

Is there way to prevent or detect this threat using a SIEM tool such as Splunk?

  • I cannot think of a way to enable BitLocker protection on a system drive where the authorized user can't boot into Windows and simply disable it.
    – Ramhound
    Sep 7, 2020 at 4:25
  • Delete the bitlocker service in the registry is one way.
    – Moab
    Sep 7, 2020 at 12:17
  • Via group policy you can force all Bitlocker enabled machines to place the recovery key in Active Directory. Hence on a well configured domain such a ransomware attack would not have a big effect - and I would assume that companies are the profitable attack targets... AFAIK also personal Windows installations which use Microsoft account also save Bitlocker key but this time in the Microsoft account. Of course the ransomware could try to delete it from there - not sure if Microsoft can restore deleted Bitlocker recovery keys.
    – Robert
    Sep 8, 2020 at 14:02
  • Thank you all for replying! Much appreciated.
    – Marklov
    Sep 10, 2020 at 2:27
  • Can anyone suggest a way to detect if someone removed the Recovery Key on ActiveDiretory? Any windows security log for this?
    – Marklov
    Sep 10, 2020 at 2:45


You must log in to answer this question.

Browse other questions tagged .