Audit Policy Tampering Via Auditpol
This rule detects attempts to tamper with Windows audit policies using the `auditpol.exe` utility. Threat actors often modify audit policies to impair detection capabilities by disabling, clearing, removing, or restoring specific audit policies, thereby reducing the logging of their malicious activities.
Sigma
