Audit Policy Tampering Via Auditpol (0a13e132-651d-11eb-ae93-0242ac130002)
Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.