mdecrevoisier high experimental sigma

BitLocker feature activation on multiple hosts (native)

Detects scenarios where an attacker enable or reconfigure BitLocker on multiple hosts for ransomware purposes.

View Source

Detection Logic

{
  "selection": {
    "Channel": "Microsoft-Windows-BitLocker/BitLocker Management",
    "EventID": [
      768,
      775
    ]
  },
  "condition": "selection
| count(Hostname) by SecurityUserID > 10"
}

False Positives

  • ⚠ Initial BitLocker configuration

Field Validations

Loading…

Comments (0)

Loading comments...