UAT-8302 Queries Security Log Configuration and Audit Policy

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•10

Detects collection of event log size, retention, record count, and audit policy categories to understand defensive visibility. This rule specifically looks for the execution of 'powershell.exe' with 'Get-WinEvent -ListLog Security' or 'auditpol.exe' with '/get /category' command-line arguments.