BitLocker Key Retrieval from Azure Audit Logs

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•47

This rule detects attempts to read or retrieve BitLocker recovery keys from Azure audit logs. This activity can be indicative of an attacker attempting to gain access to encrypted data on compromised devices or to bypass disk encryption for persistence or defense evasion.