Suspicious BitLocker Registry Configuration via Reg.exe

This brief addresses the unauthorized modification of Windows BitLocker Drive Encryption (BDE) registry policies via the native reg.exe utility. Threat actors, specifically those deploying ransomware, may attempt to modify these registry keys to bypass security requirements, such as forcing the use of BitLocker without a TPM, or changing startup and recovery authentication settings. Monitoring these changes is critical for identifying potential persistence mechanisms or pre-ransomware staging activities where an attacker prepares an environment for full-disk encryption or key recovery manipulation. These modifications typically occur within \SOFTWARE\Policies\Microsoft\FVE.

Impact

Successful manipulation of BitLocker policies can lead to the weakening of system encryption security, unauthorized access to recovery keys, or the preparation for widespread ransomware deployment. These actions serve as a key indicator that an adversary has established sufficient local administrative access to influence critical host-level security configurations.

Recommendation

Detection engineering teams should implement monitoring for registry-based modifications to BitLocker policies.

• Deploy the provided Sigma rule to detect reg.exe commands targeting BitLocker registry keys.
• Baseline legitimate administrative changes to FVE policies to reduce noise.
• Investigate any process creating or modifying these registry keys when performed by non-standard management processes (e.g., unexpected CMD/PowerShell scripts).