Suspicious Audit Policy Manipulation Through Auditpol (via process_creation)

This rule detects threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.