Impair Defenses: Disable Windows Event Logging using autitpol.exe
An attacker disables or weakens Windows auditing to reduce the visibility of system and user activity. This helps evade detection by security tools and analysts by preventing critical events from being recorded in Windows Event Logs.
Sigma
