The Evidence of execution might be your forensic solution.

Office documents will continue to be the most common methods used by attackers to trick users and execute malicious activity.

Shadow Copies is the one thing you need to add your Forensics activity list.

RDP is that thing you want to investigate...

Registry Hives are one of the major evidence providers for us, the analysts.

BIOC or IOC? Maybe both?