Detect New Local Admin account
Local Account , Create Account
Local Account , Create Account
Remote Desktop Protocol , Remote Services
Indicator Removal on Host , Clear Windows Event Logs
Local Account , Create Account
Path Interception by Unquoted Path , Hijack Execution Flow