Office 365 Unified Audit Log Disabled
This rule detects when the Unified Audit Log (UAL) is disabled in Office 365. This is identified by monitoring for the 'Set-AdminAuditLogConfig' product event type where the 'UnifiedAuditLogIngestionEnabled' field is set to 'False'. Disabling the UAL can indicate an adversary attempting to impair defenses and avoid detection by preventing their actions from being logged.
YARA-L
