Member Added to Security-Enabled Global Group
This rule detects when a new member is added to a security-enabled global group in a Windows environment. This activity is significant because adding users to such groups can grant them elevated privileges or access to sensitive resources, making it a common action for adversaries attempting privilege escalation or persistence.
Sigma
