Warning signs include unexpected password resets, logins from unusual locations, systems running slowly, colleagues receiving strange emails "from" you, and unexpected software or accounts. Trust your instincts—if something feels wrong, investigate.
Quick answer: Warning signs include unexpected password resets, logins from unusual locations, systems running slowly, colleagues receiving strange emails "from" you, and unexpected software or accounts. Trust your instincts—if something feels wrong, investigate.
Warning Signs
Account and access issues
- Password reset emails you didn't request
- Locked out of accounts
- Logins from locations you haven't been (check your sign-in history)
- MFA prompts you didn't trigger
- New accounts you didn't create
- Admin accounts with changed permissions
Email red flags
- Colleagues asking about emails you didn't send
- Emails in your sent folder you don't recognise
- Missing emails
- Email rules forwarding messages to external addresses
- Bouncebacks for emails you didn't send
System behaviour
- Computers running unusually slowly
- Programmes starting or running that you didn't launch
- Browser redirecting to strange sites
- Antivirus disabled or uninstalled
- Files encrypted or inaccessible (ransomware)
- Files in unexpected locations
Network issues
- Unusual network traffic (particularly outbound)
- Connections to unknown IP addresses
- Data usage spikes
- DNS requests to unusual domains
Financial signs
- Unauthorised transactions
- Invoices from vendors you don't recognise
- Customer complaints about fake invoices "from" you
- Bank detail change requests you didn't make
What to Do If You Suspect Compromise
Don't panic. Don't tip off attackers.
1. Gather information first
Note what you've observed. When did it start? What exactly is happening? Which systems or accounts are affected?2. Isolate if necessary
If you're seeing active ransomware or clear malicious activity, disconnect affected systems from the network. Otherwise, keep systems running for investigation.3. Check the obvious
- Review sign-in logs (Microsoft 365: Security → Sign-ins)
- Check for forwarding rules on email
- Review recently installed software
- Check for new admin accounts
4. Get expert help
If you're not sure what you're looking at, get help. Mishandling incident response can make things worse.5. Preserve evidence
Don't wipe systems or delete logs until you understand what happened. You may need forensic evidence.How Attackers Stay Hidden
Modern attackers try to avoid detection:
- They use legitimate tools already on your systems
- They operate during business hours to blend in
- They move slowly to avoid triggering alerts
- They maintain access through multiple methods
Prevention: Know Your Normal
You can't spot abnormal if you don't know what normal looks like.
- Enable sign-in logging and review it
- Use security monitoring tools
- Set up alerts for unusual activity
- Know who should have admin access
- Document what systems connect to what
What We Provide
Our security services include monitoring that catches these signs:
- MDR - 24/7 monitoring for suspicious endpoint behaviour
- SIEM - Log analysis to spot unusual patterns
- Microsoft 365 monitoring - Alerts for risky sign-ins and unusual activity
---
- we can help investigate.
---