In this particular case, someone was granted execute on DBMS_SQL. I'm looking for whatever I can find about who/when the grant occurred.

Where should I look for this?

Thanks!