Account added and removed from privileged groups

'Identifies accounts that are added to a privileged group and then quickly removed, which could be a sign of compromise.'