Kubernetes GCP detect most active service accounts by pod

Detect New Local Admin account

Local Account, Create Account

Remote Desktop Network Traffic

Remote Desktop Protocol, Remote Services

Short Lived Windows Accounts

Local Account, Create Account

Windows Event Log Cleared

Indicator Removal, Clear Windows Event Logs