The built-in audit policy tool sets a subcategory or category to stop generating success/failure audit events; auditpol /clear /y wipes the entire advanced audit policy. Either action suppresses the events defenders rely on.
Use Turn off auditing for noisy categories (e.g. process creation, logon) before operating, so key telemetry is never written.
Detection: Alert on Event ID 4719 (System audit policy was changed) and 4907. Log process creation for auditpol.exe with '/set ... /success:disable', '/failure:disable', '/clear', or '/remove'. Periodically compare live 'auditpol /get /category:*' output against a known-good baseline.
Verified
✓ MS Learn auditpol-set confirms '/set ... /category:<name> /success:<enable|disable> /failure:<enable|disable>' and auditpol '/clear'/'/remove' sub-commands; ATT&CK T1562.002. No change.