Audit Policy Tampering Via NT Resource Kit Auditpol
This rule detects attempts to tamper with Windows audit policies using an older version of the `auditpol` binary, specifically from the NT resource kit. Adversaries may use this method to disable or remove certain audit policies, or restore a custom policy, thereby impairing detection capabilities by limiting the logging of security-relevant events.
Sigma
