Too Many Global Admins — Detection Rule

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read the full analysis on IntelFusions