اختبار شهادة امن المعلومات CompTIA Security+

After an alert was triggered, a security analyst observed the following log:
Event ID: 4728
A member was added to the security-enabled global group.
Subject:
Security ID: Comptia\bob
Account Name: bob
Account Domain: Comptia
Member:
Security ID: Comptia\alice
Account name: cn=alice cn=user dc=AD dc=Comptia
Group:
Security ID: Comptia\Domain Admins
Groupname: Domain Admins
Groupdomain: Comptia
The log has no corresponding change request documented in the company's system. Which of the following application attacks is occurring?