LATERAL MOVEMENT - BITLOCKER

Summary from the TLDR InfoSec newsletter

BitLocker is a full disk encryption feature for Windows that protects data at rest by encrypting full volumes. This post outlines a privilege escalation or lateral movement technique that uses Windows Management Instrumentation (WMI) to hijack specific COM objects of BitLocker using remote manipulation of BitLocker registry keys to execute code under the user's context on a target host. The post also discusses detection opportunities for this attack and Sigma and Windows Defender for Endpoint queries to detect them.