Local Administrator Account Disabled via GPO Push (PAYLOAD-style)
Detects the disabling of the built-in 'Administrator' account initiated by a system-level process (e.g., service or background task), which is characteristic of GPO enforcement or malicious tampering.
Sigma
