Suspicious Changes to File Associations
Change Default File Association
Change Default File Association
Remote Desktop Protocol, Remote Services
Windows Service, Create or Modify System Process
Cloud Accounts
Exfiltration Over Alternative Protocol