Azure Audit Logs: BitLocker Key Read Activity
Alerts on Azure audit events reading BitLocker keys, which can enable recovery and encryption bypass.
- Product
- azure
- Service
- auditlogs
- Author
- Michael Epping, '@mepples21' (SigmaHQ), DRL 1.1
- Published
- 2022-06-28
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags events where BitLocker keys are read in Azure audit logs (Category KeyManagement, OperationName Read BitLocker key). Attackers may use key retrieval to enable or facilitate access to encrypted data and systems as part of privilege escalation or persistence. The detection relies on Azure audit log telemetry that records the specific key-management read operation.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Audit Logs: BitLocker Key Read Activity"
id: 61c4b97d-8565-4d3d-b01f-4f9bdf042a7e
status: test
description: This rule flags events where BitLocker keys are read in Azure audit logs (Category KeyManagement, OperationName Read BitLocker key). Attackers may use key retrieval to enable or facilitate access to encrypted data and systems as part of privilege escalation or persistence. The detection relies on Azure audit log telemetry that records the specific key-management read operation.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078.004
logsource:
product: azure
service: auditlogs
detection:
selection:
Category: KeyManagement
OperationName: Read BitLocker key
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: a0413867-daf3-43dd-9245-734b3a787942
type: derived