FW-TPM-RELAYCredential Access

TPM Sniffing / Relay (BitLocker)

Sniff the LPC / SPI bus while TPM unseals the BitLocker key (10 USD logic analyzer demos) — recover the FVEK, decrypt the disk offline.

§ Where this technique fits

FW-TPM-RELAY is catalogued under the Credential Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

Evil maid → sniff TPM unseal → decrypt BitLocker offline
Brief physical access to a TPM-only BitLocker laptop. Plug a logic analyser onto the LPC / SPI bus; capture the FVEK as the TPM unseals it at boot. Take the disk home, decrypt offline.
step 3 / 6

§ What commonly comes next

01
File and Directory Discovery
T1083 · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Evil maid → sniff TPM unseal → decrypt BitLocker offline

§ What commonly comes next