GreatXML bypasses Windows BitLocker via WinRE
A researcher disclosed GreatXML, a BitLocker bypass triggered by copying XML files to the recovery partition and booting into Windows Recovery Environment, granting unrestricted volume access.
Security researcher Chaotic Eclipse has released GreatXML, a new Windows BitLocker bypass vulnerability discovered accidentally within four hours. The exploit targets systems where Windows Defender Offline Scan has been used at least once, though the researcher suggests the vulnerability may be triggerable without prior use of that feature.
The attack vector involves placing specially crafted XML files (unattend.xml and Recovery/WindowsRE/ReAgent.xml) in the recovery partition's root directory, then rebooting into Windows Recovery Environment by holding Shift during restart. When executed correctly, the exploit spawns a shell with unrestricted access to the BitLocker-protected volume, effectively bypassing disk encryption protections.
This disclosure follows Chaotic Eclipse's recent release of RoguePlanet, a Microsoft Defender zero-day enabling local privilege escalation to SYSTEM, and represents their second BitLocker bypass after YellowKey (CVE-2026-45585), which Microsoft patched in this week's Patch Tuesday updates. The rapid succession of disclosures from this researcher highlights ongoing challenges in Windows security architecture, particularly around recovery mechanisms and credential management.
Mentioned in this report
Detection guidance
Suspicious Creation or Modification of Recovery Environment Configuration Files (unattend.xml / ReAgent.xml)
Detects creation or modification of unattend.xml or ReAgent.xml on recovery partitions, consistent with WinRE-based BitLocker bypass staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Recovery Partition XML Configuration File Write
id: 3deea723-5743-5a63-a202-02016cdb1dd0
status: experimental
description: 'Detects file creation or modification events for unattend.xml or ReAgent.xml
located under a Recovery\WindowsRE directory or at the root of a volume, which is
the staging technique used by the GreatXML BitLocker bypass to plant malicious answer
files that are processed when booting into Windows Recovery Environment.
'
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- \Recovery\WindowsRE\ReAgent.xml
- \unattend.xml
filter:
Image|endswith:
- \TrustedInstaller.exe
- \reagentc.exe
- \dism.exe
- \sysprep.exe
condition: selection and not filter
falsepositives:
- Legitimate OEM imaging, Sysprep, or deployment tooling that writes unattend.xml
or ReAgent.xml as part of authorized provisioning
- Administrator-driven WinRE customization performed via DISM or reagentc.exe
level: high
tags:
- attack.t1490
- attack.defense_evasion
author: Vorant
ReagentC Command Forcing Boot Into Windows Recovery Environment
Detects use of reagentc.exe to enable or force the next boot into WinRE, a step attackers can abuse to trigger processing of malicious recovery XML files for BitLocker bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ReagentC Used to Force Boot Into WinRE
id: 4317dae8-9512-5fbd-811b-436ea9928670
status: experimental
description: 'Detects execution of reagentc.exe with flags that enable the recovery
environment or force the machine to boot into WinRE on next restart (/boottore,
/enable). This is a legitimate administrative tool but is abused as part of the
GreatXML BitLocker bypass to trigger processing of maliciously placed unattend.xml/ReAgent.xml
files.
'
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \reagentc.exe
CommandLine|contains:
- /boottore
- /enable
filter:
ParentImage|endswith:
- \TiWorker.exe
- \TrustedInstaller.exe
condition: selection and not filter
falsepositives:
- IT administrators intentionally forcing a boot into WinRE for legitimate recovery
or troubleshooting
- Automated deployment scripts that re-enable Windows Recovery Environment after imaging
level: medium
tags:
- attack.t1490
- attack.t1068
- attack.defense_evasion
author: Vorant
Shell Process Spawned From Windows Recovery Environment RAM Disk
Detects process creation events originating from the WinRE X:\ RAM disk environment, indicating an interactive shell obtained during recovery boot that may be used to directly access BitLocker-protected volumes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution From WinRE RAM Disk Drive
id: 9fb3182c-20cb-51d9-9549-6d1a6cf828ae
status: experimental
description: 'Detects process creation where the executed image or its parent resides
on the X:\ drive, which is the RAM disk letter assigned during Windows Recovery
Environment (WinRE) sessions. Legitimate recovery tools run here, but an unexpected
interactive shell (cmd.exe, powershell.exe) launched from X:\ is consistent with
the GreatXML technique of obtaining unrestricted shell access to bypass BitLocker
via WinRE.
'
logsource:
category: process_creation
product: windows
detection:
selection:
Image|startswith: X:\
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
condition: selection
falsepositives:
- Legitimate use of the command prompt or PowerShell from WinRE by support staff during
authorized recovery operations
- OEM or IT recovery tools that intentionally launch scripting engines from the WinRE
RAM disk
level: medium
tags:
- attack.t1006
- attack.defense_evasion
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/new-greatxml-exploit-bypasses-windows.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free