Important Windows Event Auditing Disabled
Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. This rule specifically looks for Event ID 4719, which indicates a change in audit policy, combined with specific Subcategory GUIDs and audit policy change codes ('%%8448' for Success removed or '%%8450' for Failure removed).
Sigma
