How to prevent malicious use of BitLocker

Ask Question

Asked 3 years ago

Modified 3 years ago

Viewed 123 times

I was wondering if anyone has thought about a scenario in which BitLocker can be used as ransomware.

For example, if the hacker was granted access to the system, and used BitLocker to encrypt the disk.

Is there way to prevent or detect this threat using a SIEM tool such as Splunk?

warren

9,93023 gold badges86 silver badges147 bronze badges

asked Sep 7, 2020 at 3:59

Marklov

111 bronze badge

I cannot think of a way to enable BitLocker protection on a system drive where the authorized user can't boot into Windows and simply disable it.
– Ramhound
Sep 7, 2020 at 4:25
Delete the bitlocker service in the registry is one way.
– Moab
Sep 7, 2020 at 12:17
Via group policy you can force all Bitlocker enabled machines to place the recovery key in Active Directory. Hence on a well configured domain such a ransomware attack would not have a big effect - and I would assume that companies are the profitable attack targets... AFAIK also personal Windows installations which use Microsoft account also save Bitlocker key but this time in the Microsoft account. Of course the ransomware could try to delete it from there - not sure if Microsoft can restore deleted Bitlocker recovery keys.
– Robert
Sep 8, 2020 at 14:02
Thank you all for replying! Much appreciated.
– Marklov
Sep 10, 2020 at 2:27
Can anyone suggest a way to detect if someone removed the Recovery Key on ActiveDiretory? Any windows security log for this?
– Marklov
Sep 10, 2020 at 2:45

Add a comment |

0