Azure Audit Logs: BitLocker Key Retrieval via Read BitLocker key

title: "Azure Audit Logs: BitLocker Key Retrieval via Read BitLocker key"
id: 61c4b97d-8565-4d3d-b01f-4f9bdf042a7e
status: test
description: "This rule flags Azure Audit Log events where the operation reads a BitLocker key (Category: KeyManagement, OperationName: Read BitLocker key). Attackers may attempt to obtain BitLocker recovery material to bypass device encryption during privilege escalation or persistence. The detection relies on Azure audit log telemetry containing the specific KeyManagement category and the exact operation name."
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: KeyManagement
    OperationName: Read BitLocker key
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a0413867-daf3-43dd-9245-734b3a787942
    type: derived