Bulk Deletion Changes To Privileged Account Permissions — Detection Rule

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Read the full analysis on IntelFusions