Important Windows Event Auditing Disabled — Detection Rule

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.