I was wondering if anyone has thought about a scenario in which BitLocker can be used as ransomware.

For example, if the hacker was granted access to the system, and used BitLocker to encrypt the disk.

Is there way to prevent or detect this threat using a SIEM tool such as Splunk?

  • I cannot think of a way to enable BitLocker protection on a system drive where the authorized user can't boot into Windows and simply disable it. – Ramhound Sep 7 '20 at 4:25
  • Delete the bitlocker service in the registry is one way. – Moab Sep 7 '20 at 12:17
  • Via group policy you can force all Bitlocker enabled machines to place the recovery key in Active Directory. Hence on a well configured domain such a ransomware attack would not have a big effect - and I would assume that companies are the profitable attack targets... AFAIK also personal Windows installations which use Microsoft account also save Bitlocker key but this time in the Microsoft account. Of course the ransomware could try to delete it from there - not sure if Microsoft can restore deleted Bitlocker recovery keys. – Robert Sep 8 '20 at 14:02
  • Thank you all for replying! Much appreciated. – Marklov Sep 10 '20 at 2:27
  • Can anyone suggest a way to detect if someone removed the Recovery Key on ActiveDiretory? Any windows security log for this? – Marklov Sep 10 '20 at 2:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.