Exchange Online Audit Logging Disabled (Defense Evasion)
Detects attempts to disable audit logging features in Microsoft 365, specifically mailbox auditing (via Set-Mailbox) or unified audit log ingestion (via Set-AdminAuditLogConfig). Disabling these features can be a precursor to unauthorized activities, as it prevents the capture of user actions and administrative changes.
Microsoft Sentinel (KQL)
