@@ -9,15 +9,21 @@ description: Simulated Windows Security and System events demonstrating the
99 BitLocker Network Unlock COM Object Hijacking lateral movement technique
1010 (T1574.015 / T1546.015) using RemoteRegistry service enablement, HKCU CLSID
1111 manipulation, and execution via baaupdate.exe or BdeUISrv.exe.
12+ environment : NA
13+ directory : bitlocker_com_hijacking
14+ mitre_technique :
15+ - T1546.015
1216references :
1317 - https://ipurple.team/2025/08/04/lateral-movement-bitlocker/
1418 - https://github.com/rtecCyberSec/BitlockMove
1519attack_data :
1620 - file_name : windows-security.log
17- data : datasets/attack_techniques/T1546.015/bitlocker_com_hijacking/windows-security.log
18- source : WinEventLog:Security
19- sourcetype : WinEventLog:Security
21+ data : datasets/attack_techniques/T1546.015/
22+ bitlocker_com_hijacking/windows-security.log
23+ source : XmlWinEventLog:Security
24+ sourcetype : XmlWinEventLog:Security
2025 - file_name : windows-system.log
21- data : datasets/attack_techniques/T1546.015/bitlocker_com_hijacking/windows-system.log
22- source : WinEventLog:System
23- sourcetype : WinEventLog:System
26+ data : datasets/attack_techniques/T1546.015/
27+ bitlocker_com_hijacking/windows-system.log
28+ source : XmlWinEventLog:System
29+ sourcetype : XmlWinEventLog:System
0 commit comments