EFS recovery policy was changed. Can affect encrypted file recovery capabilities.
EFS policy manipulation to prevent encrypted file recovery. Ransomware may modify EFS recovery agents to complicate data recovery.
Alert: EFS recovery policy changes outside documented maintenance.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4714 // Encrypted data recovery policy was changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4714
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Encrypted data recovery policy was changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Encrypted data recovery policy was changed. EFS recovery policy was changed. Can affect encrypted file recovery capabilities.
Event 4714 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Policy Change' subcategory (Success and/or Failure).
Alert: EFS recovery policy changes outside documented maintenance.