A Member Was Added to a Security-Enabled Global Group — Detection Rule

Detects activity when a member is added to a security-enabled global group

Read the full analysis on IntelFusions