value:  APT29 renamed a version of AdFind to sqlceip.exe or csrss.exe in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process respectively. 
name: Masquerading: Match Legitimate Name Or Location