"Nested member added to group" and "Nested member removed from group" events are recorded with details similar to the following:
What: Domain\User1 was added to group BUILTIN\Administrators as an indirect member of nested group CN=Domain Admins,CN=Users,DC=Domain,DC=com.
How are these events generated?