User Added to Privileged Group Detection

This query monitors users added to specific privilege groups, helping identify unauthorized additions.

Microsoft Sentinel (KQL)