Kubernetes GCP detect RBAC authorizations by account

Detect Mimikatz Via PowerShell And EventCode 4703

LSASS Memory

Anomalous usage of 7zip

Archive via Utility, Archive Collected Data

Windows System Script Proxy Execution Syncappvpublishingserver

System Script Proxy Execution, System Binary Proxy Execution

Abnormally High AWS Instances Terminated by User

Cloud Accounts