New member added to a "OCS/Lync/Skype for Business" administration group (low risk)

Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.