Which Indicator of Compromise might be detected as variations in the behavior of privileged users that indicate that their account is being used by someone else...