Have I Been Breached?

Identity & Access

Unusual or repeated MFA push notifications Receiving unexpected Multi-Factor Authentication prompts to approve logins (often MFA fatigue or prompt spamming attacks). critical severity

Login alerts from unfamiliar devices or locations Access logs or security warnings showing login attempts from geographic regions where your team is not located. high severity

Unauthorized admin accounts or permission modifications New administrator profiles created or unexpected group membership changes in your Microsoft 365, Google Workspace, or Active Directory. high severity

Unsolicited password reset request emails or alerts Receiving account recovery codes or password change confirmations that you or your team did not trigger. medium severity

System & Endpoint

Antivirus or EDR software disabled or modified Security clients (like Windows Defender, SentinelOne, or CrowdStrike) turned off, uninstalled, or having directories whitelisted. critical severity

Unexpected remote control software installed Applications like AnyDesk, TeamViewer, RustDesk, ScreenConnect, or GoToMyPC appearing on systems without IT approval. high severity

Files renamed or showing modified file extensions Documents, databases, or images suddenly changing names, getting encrypted, or appending extensions like .locked or .crypt. critical severity

Unexplained resource usage or browser redirects Workstations running hot with high CPU usage, unexpected pop-ups, or search engines redirecting to unknown portals. medium severity

Network & Traffic

Unusually heavy outbound network traffic spikes Large amounts of data uploading to external storage sites, unknown IP addresses, or file sharing platforms (potential data exfiltration). critical severity

Firewall alerts of outbound connections to malicious IPs Internal devices attempting to contact known command-and-control (C2) domains or suspicious external nodes. high severity

Spikes in queries to randomized or dynamic DNS domains High volume of DNS requests to long, randomized, or newly registered domains (common with DGA-based malware). high severity

Network scans originating from local endpoints Local servers or laptops performing network sweeps or port scans (e.g., SMB on port 445, RDP on 3389) seeking lateral movement. high severity

Communications & Operations

Clients reporting phishing or spam from your address Contacts notifying you that they received suspicious messages, invoices, or files originating from your email account. medium severity

Unauthorized banking, routing, or payment changes Urgent requests to update routing numbers, banking accounts, or payment terms for pending vendor invoices or payroll accounts. critical severity

Hidden inbox rules or auto-forwarding configured Mailbox rules created without your knowledge that automatically forward emails to external addresses or move messages to trash or RSS folders. critical severity

Sudden account lockouts or session invalidations Being unexpectedly signed out of Microsoft 365, Workspace, or line-of-business applications and unable to log in again. high severity

Identity & Access

System & Endpoint

Network & Traffic

Communications & Operations

System Secure

Request Confidential Diagnostic Review