{"id":"6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984","title":"BaaUpdate.exe Suspicious DLL Load","description":"Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.\nThis technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)\nwhich can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-18","modified":"","tags":["attack.stealth","attack.t1218","attack.lateral-movement","attack.t1021.003"],"technique_ids":["T1021.003","T1218"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/rtecCyberSec/BitlockMove"],"source_path":"rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml","source_sha256":"811b7d60602b81528740b407171b60906ac6314e6000d72232d22158839c784b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: BaaUpdate.exe Suspicious DLL Load\nid: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984\nrelated:\n    - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 # Suspicious BitLocker Access Agent Update Utility Execution\n      type: similar\nstatus: experimental\ndescription: |\n    Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.\n    This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)\n    which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.\nreferences:\n    - https://github.com/rtecCyberSec/BitlockMove\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-10-18\ntags:\n    - attack.stealth\n    - attack.t1218\n    - attack.lateral-movement\n    - attack.t1021.003\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\BaaUpdate.exe'\n        ImageLoaded|endswith: '.dll'\n        ImageLoaded|contains:\n            - ':\\Perflogs\\'\n            - ':\\Users\\Default\\'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\Temp\\'\n            - '\\AppData\\Local\\Temp\\'\n            - '\\AppData\\Roaming\\'\n            - '\\Contacts\\'\n            - '\\Favorites\\'\n            - '\\Favourites\\'\n            - '\\Links\\'\n            - '\\Music\\'\n            - '\\Pictures\\'\n            - '\\ProgramData\\'\n            - '\\Temporary Internet'\n            - '\\Videos\\'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.003","id":"T1021.003","name":"Distributed Component Object Model","page":"techniques/enterprise/T1021.003/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984.json","kind":"sigma"}