GreatXML BitLocker Bypass: Detecting Recovery Partition XML Attacks

---
title: Potential Recovery Partition Mounting via Diskpart
id: 9c8f1b23-4d5e-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to mount the recovery partition using diskpart, a common precursor to GreatXML attacks.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_diskpart:
    Image|endswith: '\diskpart.exe'
  selection_mount:
    CommandLine|contains:
      - 'assign letter='
      - 'mount' 
  selection_recovery:
    CommandLine|contains:
      - 'recovery'
      - 'hidden'
      - 'protected'
  condition: all of selection_*
falsepositives:
  - Legitimate IT administration of recovery partitions
level: high
---
title: Modification of WinRE or Offline Scan XML Files
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects modifications to XML files in the Windows Recovery or Defender Offline scan directories.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: file_change
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\Windows\System32\Recovery\'
      - '\Windows\WinSxS\'
      - '\Recovery\WindowsRE\'
  selection_ext:
    TargetFilename|endswith: '.xml'
  selection_ops:
    Operation:
      - 'File Modified'
      - 'File Renamed'
  condition: all of selection_*
falsepositives:
  - Windows Updates modifying recovery components
  - Legitimate recovery tool usage
level: medium

// Hunt for suspicious access to Recovery Partition configurations
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessCommandLine contains "diskpart" and ProcessCommandLine contains "assign") or 
       (ProcessCommandLine contains "mountvol" and ProcessCommandLine contains "recovery")
| extend DiskPartCommand = extract(@'(assign\sletter=\w)', 0, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, DiskPartCommand
| order by Timestamp desc


// Monitor for modifications to XML files in sensitive system/recovery paths
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileModified", "FileCreated", "FileRenamed")
| where FolderPath has "Recovery" or FolderPath has "WinSxS"
| where FileName endswith ".xml"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, ActionType
| order by Timestamp desc

-- Hunt for recent modifications to Recovery Partition XML files
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="C:/Windows/System32/Recovery/**/*.xml")
WHERE Mtime > now() - ISO8601Duration("P7D")

-- Hunt for Windows Defender Offline Scan artifacts in WinRE
SELECT FullPath, Mtime, Size
FROM glob(globs="C:/Windows/WinSxS/**/*.xml")
WHERE FullPath =~ "Defender" AND Mtime > now() - ISO8601Duration("P7D")

<#
.SYNOPSIS
    Audit and Hardening Script against GreatXML Bypass
.DESCRIPTION
    Checks BitLocker status, verifies Recovery Partition integrity, and alerts on recent XML modifications.
#>

Write-Host "[+] Starting GreatXML Hardening Audit..." -ForegroundColor Cyan

# 1. Check BitLocker Status
Write-Host "[+] Checking BitLocker Status..." -ForegroundColor Cyan
$BitLockerStatus = Get-BitLockerVolume -MountPoint "C:" | Select-Object MountPoint, VolumeStatus, ProtectionStatus, KeyProtector
if ($BitLockerStatus.ProtectionStatus -eq "On") {
    Write-Host "    [OK] BitLocker is ON for C:" -ForegroundColor Green
    # Check for TPM + PIN (Strong) vs TPM Only (Weak against physical DMA/hardware attacks)
    if ($BitLockerStatus.KeyProtector.KeyProtectorType -contains "RecoveryPassword" -and $BitLockerStatus.KeyProtector.KeyProtectorType -contains "TPM") {
        Write-Host "    [WARN] System relies on TPM only. Consider enabling TPM+PIN." -ForegroundColor Yellow
    }
} else {
    Write-Host "    [CRITICAL] BitLocker is OFF." -ForegroundColor Red
}

# 2. Audit Recovery Partition Access Permissions (Basic Check)
Write-Host "[+] Auditing Recovery Partition ACLs..." -ForegroundColor Cyan
$RecoveryPath = "C:\Windows\System32\Recovery"
if (Test-Path $RecoveryPath) {
    $Acl = Get-Acl $RecoveryPath
    $Acl.Access | Where-Object { $_.IdentityReference -notmatch "SYSTEM|Administrators|TrustedInstaller" -and $_.FileSystemRights -notmatch "Read" } | 
    Format-List IdentityReference, FileSystemRights
} else {
    Write-Host "    [INFO] Standard recovery path not found (Custom config?)." -ForegroundColor Gray
}

# 3. Check for recently modified XML files in Recovery Paths
Write-Host "[+] Checking for recent XML modifications in System/Recovery paths..." -ForegroundColor Cyan
$DateThreshold = (Get-Date).AddDays(-7)
$SuspiciousFiles = Get-ChildItem -Path "C:\Windows\System32\Recovery", "C:\Windows\WinSxS" -Filter *.xml -Recurse -ErrorAction SilentlyContinue | 
                  Where-Object { $_.LastWriteTime -gt $DateThreshold }

if ($SuspiciousFiles) {
    Write-Host "    [ALERT] Found recently modified XML files:" -ForegroundColor Red
    $SuspiciousFiles | Format-Table FullName, LastWriteTime, Length
} else {
    Write-Host "    [OK] No suspicious recent XML modifications found." -ForegroundColor Green
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan