Initial upload

splunk · Feb 10, 2025 · 5c06969 · 5c06969
1 parent c08731f
commit 5c06969
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands.log b/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands.log
diff --git a/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands.yml b/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands.yml
@@ -0,0 +1,14 @@
+author: Steven Dick
+id: 2cf75567-0739-4cd2-8d83-fd5c0177045e
+date: '2025-02-10'
+description: 'A sample event with a known abusedd manage-bde command.'
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands.log
+sourcetypes:
+- XmlWinEventLog
+references:
+- https://attack.mitre.org/techniques/T1486/
+- https://www.nccgroup.com/us/research-blog/nameless-and-shameless-ransomware-encryption-via-bitlocker/
+- https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
+- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/