Remote Desktop Network Traffic

Remote Desktop Protocol , Remote Services

Windows Event Log Cleared

Indicator Removal on Host , Clear Windows Event Logs

Short Lived Windows Accounts

Local Account , Create Account

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path , Hijack Execution Flow

Kubernetes GCP detect service accounts forbidden failure access