New member added to an "OCS/Lync/Skype for Business" administration group (high risk)

Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.