Are you collecting 4624 events from your endpoints? Look for unexpected type 10 (Remote Interactive, i.e. RDP or terminal services) logins. And look for unexplained 4720 (account created) too.
https://twitter.com/campuscodi/status/1263845168802914304 …