The moment an account gains new privileges is the moment an attacker is most likely consolidating control. Alerting on every privilege escalation — especially to admin — catches the pivot that turns a foothold into a takeover.
“New power is the attacker's favorite milestone. Watch for it.”