UEFI Persistence Via Wpbbin Process Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•26

Detects the execution of the 'wpbbin.exe' binary located in 'C:\Windows\System32\'. This binary is associated with a UEFI-based persistence method, as described in the provided references, which allows for the injection of executable files into BitLocker-protected drives.