Suspicious unattend.xml Creation (GreatXML BitLocker Bypass)
Identifies the creation or modification of unattend.xml files outside of expected deployment directories. This behavior may indicate an attempt to exploit the GreatXML zero-day vulnerability, where attackers place a crafted unattend.xml in the recovery partition to bypass BitLocker during a Windows Defender Offline Scan.
Microsoft Sentinel (KQL)
