This alerts is triggered for change in Admin group.
MITRE ATT&CK Tactics
Windows Security Event Log
Migration of an account into a new domain
Review the user accounts which have been modified and identify the account owners. Confirm if the request is valid.
If not, disable the accounts immediately and start an investigation for discovery of account use into your organization.