Rules Contributing to Microsoft Entra Bitlocker Key Retrieval Alert

The following rules are used to identify suspicious Microsoft Entra Bitlocker key retrieval activity. Any one or more of these will trigger the Microsoft Entra Bitlocker Key Retrieval Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

BitLocker Key Retrieval

Monitor and alert for BitLocker key retrieval.

Rule ID

azure_25

Query

{'selection': {'Category': 'KeyManagement', 'OperationName': 'Read BitLocker key'}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,a0413867-daf3-43dd-9245-734b3a787942

Author: Michael Epping, '@mepples21'

Tactics, Techniques, and Procedures

CREDENTIAL_ACCESS, T1555

References

Severity

50

Suppression Logic Based On

  • azure_ad.initiatedBy.user.id
  • azure_ad.initiatedBy.app.servicePrincipalId
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2022/06/28 medium

  • Unknown