MalCommands — manage-bde

#					tactics	techniques	os

detail

Command Line

set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf

Description

Set the COMSPEC variable to an arbitrary binary and execute it via calling manage-bde.wsf.

Risk

High

Risk Reason

Manual usage of this script is suspicious in most situations.

Fidelity

High

Fidelity Reason

This type of behavior is typically rare for most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: Manage-bde

Tool URL: N/A

Tool Description: Manage-bde.wsf is a Microsoft script used for managing certain aspects of BitLocker.

Common Tool Locations

C:\Windows\System32\manage-bde.wsf

Common Tool Arguments

MITRE ATT&CK TECHNIQUES

Technique: T1216 - System Script Proxy Execution

URL: https://attack.mitre.org/techniques/T1216

Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)

Tactics:

Defense Evasion