Windows Important Audit Policy Disabled

The analytic detects the disabling of important audit policies by leveraging EventCode 4719 from Windows Security Event Logs. This event indicates changes where success or failure auditing is removed for specific subcategories. Such activity suggests an attacker may be attempting to evade detection by tampering with audit policies, potentially after gaining access to a system, including a domain controller. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.