We have a bug in audit log for detach. You are right, attach should also be checked.
Checking audit service is a good idea. Thanks.