BitLocker COM hijacking shows why lateral movement should be blocked by default

At a glance

What this is: Zero Networks describes BitlockMove, a BitLocker COM hijacking path that turns normal Windows protocols into a lateral movement route.

Why it matters: It matters because identity and access assumptions around logged-in users, RPC reachability, and east-west trust can turn a single foothold into broader compromise.

Context

BitlockMove is a Windows lateral movement technique that abuses normal administrative and file-sharing paths rather than exploiting a traditional software flaw. The problem is not BitLocker itself, but the trust placed in peer-to-peer connectivity, remote registry writes, and the privileges of the current user context.

For IAM and PAM teams, the identity angle is clear: once an attacker can run code as the logged-in user and reach broad internal services, privilege boundaries become the real control point. For infrastructure teams, the governance gap is east-west openness by default, which leaves legitimate protocols available for abuse.

In this article, the starting position is typical of many enterprise Windows environments: convenience-driven connectivity is allowed first, then security teams try to react after a technique becomes public.

Key questions

Q: What fails when SMB and RPC are open by default in Windows environments?

A: When SMB and RPC are open by default, attackers can stitch together file copy, remote registry modification, and COM execution into a lateral movement chain. The failure is not just one weak service, but the absence of path control between peers. Once that path exists, the attacker can turn a legitimate user context into remote code execution.

Q: Why does broad user access make BitLocker COM hijacking more dangerous?

A: Broad user access increases the blast radius after the DLL is loaded because the attack executes in the context of the current user. If that user can reach many internal systems, shares, or administrative interfaces, the attacker can fan out without needing to break additional controls. Identity scope becomes the multiplier.

Q: How do organisations know if lateral movement controls are actually working?

A: They work when a compromised endpoint cannot reach other critical systems by default. Measure this by reviewing allowed east-west paths, testing whether backups and OT networks are isolated, and simulating attacker movement from a single workstation. If one foothold can still reach many assets, the control is not effective enough.

Q: Should organisations rely on detection or blocking for new Windows lateral movement techniques?

A: Blocking has to come first when the attack path depends on routine Windows protocols. Detection is still useful, but it becomes a backstop rather than the primary defence. If the environment allows SMB, RPC, and DCOM by default, every new technique forces a race that defenders are likely to lose.

Technical breakdown

How BitLocker COM hijacking is used for lateral movement

BitlockMove chains together SMB, WMI or RPC, and DCOM to abuse a trusted Windows workflow. The attacker first places a DLL on the target over SMB, then writes a registry value remotely so BitLocker is pointed at that DLL path, and finally triggers COM activity that causes the DLL to load in the context of the logged-in user. This is not a privilege-escalation exploit in the classic sense. It is a protocol orchestration problem in which normal management channels are used to cause code execution on a remote host.

Practical implication: if SMB, RPC, and DCOM are available by default between peers, the attack chain can succeed without any exotic exploit.

Why broad user rights turn protocol abuse into spread

The technique becomes more dangerous when the compromised user has broad rights across multiple systems. In that case, the attacker does not need to break encryption or bypass BitLocker protection; they only need the loaded DLL to run under a context that can reach other assets, shares, or administrative interfaces. This is why lateral movement often follows identity breadth rather than vulnerability severity. The control issue is not just code execution on one host, but how far that user session can go once the attacker inherits it.

Practical implication: map logged-in user reach carefully, because excessive network and administrative rights can turn one foothold into fleet-wide movement.

Default-deny segmentation as the real control boundary

The article’s key architectural point is that microsegmentation changes the question from 'Can this technique be blocked?' to 'Does the required path exist at all?' If peer-to-peer SMB is closed by default and dynamic RPC ports are unavailable unless explicitly approved, the chain fails before execution. Where RPC must remain open, limiting specific RPC functions creates another choke point. This is a control-plane answer to an attack-path problem, which is why chasing each new named technique is less effective than removing the underlying connectivity assumptions.

Practical implication: treat east-west access as a governed dependency, not a standing entitlement.

Threat narrative

Attacker objective: The attacker aims to gain remote code execution in a legitimate user context and use that foothold to move laterally across additional Windows assets.

1. Entry occurs when the attacker can reach the target over SMB and place a malicious DLL on the host.
2. Credential or context abuse follows when remote WMI or RPC is used to write the registry path that BitLocker will trust.
3. Execution and lateral movement occur when DCOM triggers BitLocker to load the DLL under the logged-in user, allowing fan-out if that account has broad rights.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

BitlockMove is a default-trust problem, not a BitLocker problem. The technique works because normal Windows management channels are permitted to talk to each other by default. That means the control failure sits in east-west reachability and remote function exposure, not in the application layer itself. Practitioners should therefore review connectivity policy before they chase technique-specific detections.

“Legitimate protocol stitching” is becoming the modern lateral movement pattern. Attackers increasingly combine SMB, RPC, WMI, and DCOM into one path because each step looks administrative in isolation. That makes identity and network governance inseparable: if the session context is broad and the internal path is open, the adversary does not need a new exploit to move. Teams should judge trust by reachable paths, not by protocol reputation.

Default-deny segmentation is the named concept this article strengthens. The post shows why security architecture has to remove the path, not merely monitor it. Once peer-to-peer access and dynamic RPC are governed as explicit exceptions, the attack pattern loses its operating space. Practitioners should make that exception model the baseline for Windows lateral movement control.

Privilege scope matters more than technique novelty. The attack only becomes operationally useful when the logged-in user can reach enough internal systems to matter. That is an IAM and PAM lesson as much as a network one: reduce the distance any single user session can travel. Practitioners should align access scope with blast-radius containment.

Technique churn will keep outpacing reactive rule-making. Each new named path forces defenders into a headline-driven response cycle unless the underlying trust boundary is already closed. That argues for design-time governance of SMB, RPC, and DCOM exposure rather than post-disclosure tuning. Practitioners should prioritise structural containment over per-technique cleanup.

What this signals

Default-deny lateral movement is now a governance requirement, not a tuning preference. Windows attack paths increasingly combine ordinary management channels, so defenders need to treat east-west reach as an approved dependency rather than an assumed right. That makes segmentation a core control for blast-radius reduction.

Legitimate protocol chaining is the pattern to watch. When SMB, RPC, and DCOM are all available inside the same trust zone, attackers do not need novel malware to move. Security teams should focus on whether internal paths are closed by default and only opened with explicit business justification.

For practitioners

• Enforce default-deny east-west segmentation Block peer-to-peer SMB and restrict internal RPC reachability unless a business dependency has been explicitly approved and documented.
• Tighten remote registry and RPC function exposure Limit high-port RPC paths and suppress rarely used RPC operations that allow remote registry writes or similar management actions.
• Reduce the reach of logged-in user sessions Review which internal systems a standard user context can reach and remove unnecessary administrative, share, and management access paths.
• Treat Windows management protocols as governed exceptions Maintain an approved dependency list for SMB, WMI, RPC, and DCOM so new connectivity is added by exception rather than assumed.

Key takeaways

• BitlockMove shows that an attacker can turn legitimate Windows management traffic into a lateral movement path without relying on a new exploit class.
• The decisive control is not technique-specific detection but whether SMB, RPC, and DCOM are reachable by default across peers.
• Teams should reduce blast radius by treating east-west connectivity and user reach as governed exceptions rather than standing assumptions.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• COM Hijacking: COM hijacking is a persistence technique that manipulates Windows Component Object Model registry entries so legitimate software loads attacker-controlled code. It is effective because it abuses normal operating-system behaviour rather than relying on obviously malicious file names or startup entries.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and IAM. It helps security practitioners translate identity control principles into stronger access decisions across hybrid environments.