YellowKey TxF Log Artifact Creation
Detects the creation or modification of TxF CLFS log files (FsTxLog.blf) within the System Volume Information directory, which is a primary staging mechanism for the YellowKey BitLocker bypass. The rule also identifies potential VMware MAC OUI within the Resource Manager GUID, indicating a high-confidence proof-of-concept artifact.
Microsoft Sentinel (KQL)
