User with Privileges Logon — Detection Rule

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.