Windows AD Privileged Group Modification

Detects when users are added to privileged Active Directory groups. This is a critical event as it can lead to privilege escalation and unauthorized access to sensitive resources within an Active Directory environment. The rule specifically looks for Windows Event Code 4728, which indicates a member was added to a security-enabled global group, security-enabled local group, or security-enabled universal group.