title: Suspicious BitLocker Access Agent Update Utility Execution
description: This analytic looks for suspicious BitLocker Access Agent Update Utility Execution. 
tags:
    - attack.t1574.002
author: @andrewdanis
references:
    - https://github.com/rtecCyberSec/BitlockMove
logsource:
    category: process_creation
    product: windows
detection:
    condition: 'Section_1'
    Section_1:
        ParentImage|endswith: \baaupdate.exe
falsepositives:
  - None noted. baaupdate seems to never legitimately spawn as a parent process.
level: high
status: test