Office 365 Group Member Added Successfully
This rule detects successful events where a user is added to a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Add member to group.' originating from 'Office 365' by 'Microsoft' where the security action was 'ALLOW'. The rule also identifies the user performing the action, the group name, group GUID, and the user who was added to the group.
YARA-L
