When the logs go quiet: what you see just before
Disabling the Windows event log leaves a different trail depending on how it’s done. Eight public simulations, six log sources, two Sigma rules tested against 424,348 events, and a query to catch the silence itself.