How do you detect a compromised mailbox before we notice?

Nothing breaks during a mailbox compromise, so there is no outage to notice and no alert from the thing itself. Detection has to come from watching the activity record rather than watching for failures.

What we run for clients on a managed security agreement. Your Microsoft 365 sign-in and audit logs are collected continuously into a SIEM, which is a security information and event management platform. The logs exist in your tenant either way, and the difference is whether anyone is reading them. Without this, the record sits there unexamined until after an incident, when it becomes the thing we use to work out what happened rather than the thing that would have prevented it.

The patterns that generate an alert:

• A new inbox rule or forward that sends mail out of the organization, or hides it. This is the single highest value signal there is, because almost every mailbox takeover creates one and almost no legitimate user does.
• Impossible travel. A sign-in from Jacksonville and another from overseas twenty minutes later. One of them is not your employee.
• Changes to multi-factor authentication. An attacker who registers their own authenticator keeps access through a password reset, so this matters as much as the original sign-in.
• Sign-ins from anonymizing services and unfamiliar countries, and sign-ins that succeed after a run of failures, which is a password spray finding its target.
• Someone searching the mailbox for words like invoice, wire, payment or banking, which is what reconnaissance looks like in the audit log and is not what a normal user does.
• Unusual sending volume or patterns, including mail to large numbers of external recipients.

What happens when one fires. We investigate rather than just notifying you. Depending on what we find, that can mean revoking the active sessions, which matters because changing a password alone does not kick out someone already signed in, disabling the account, removing the rule after recording it, and then telling you what we saw and what was likely read.

Two honest caveats. This is detection, not prevention, so it shortens the window rather than closing it. And it is a layer on managed security agreements rather than something every plan includes by default, so if you want to know whether your account has it, ask us and we will tell you plainly. The controls that prevent the compromise in the first place, mainly multi-factor authentication and a password manager, matter more and cost less, and they should be in place before anyone talks to you about monitoring.