Suspicious Bitlocker Encryption
Looks for potential instances of bitlocker modifying registry settings to allow encryption, where it's executed via a .bat file.
Microsoft Sentinel (KQL)

Looks for potential instances of bitlocker modifying registry settings to allow encryption, where it's executed via a .bat file.

Already have an account?