Here are some indicators which will help you detect a compromise :
- Identification of same email from public domain to significant number of users or C-level employees or high value targets; encrypted attachments, password protected and zipped and pr