I have received the following info about my active directory server 2016:
Detected potentially malicious process activity ('UAC Bypass ‑ Trusted Folder Abuse ') on your host #ADservername# by leveraging Red Cloak threat intelligence within the context of Windows process creation (WID 4688) logs.
Summary: UAC Bypass ‑ Trusted Folder Abuse (WID 4688: credwiz.exe) by "user account name here" on ADserverName\ServerIP
Kindly help me understand what this implies and what steps I should take.
Notes: This user does not sign out from the server and only "disconnects" and had recently (5 days ago) changed his password. Can this cause such an incident ?