Insider threat detection
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Unusual or unauthorized user access after BitLocker policy changes, indicating potential insider threats.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "Successful BitLocker Policy Updates"
Action2:
actionname = "Successful Policy Deployments" AND USERNAME = Action1.USERNAME
Action3:
actionname = "BitLocker Data Access and Export" AND USERNAME = Action2.USERNAME AND USERNAME = Action1.USERNAME
sequence:Action1 followedby Action2 within 10m followedby Action3 within 10m
select Action1.MESSAGE,Action1.HOSTNAME,Action1.USERNAME,Action2.MESSAGE,Action2.HOSTNAME,Action2.USERNAME,Action3.MESSAGE,Action3.HOSTNAME,Action3.USERNAME
Detection
Execution Mode
realtime
Log Sources
ME Applications
