MSSQL Disable or Drop Server Audit
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server. This action is a strong indicator of an adversary attempting to evade detection by tampering with logging mechanisms.
Sigma
