Account Lockout
Unusual amount of users logged out of their account
Concurrent Session Usage
User with multiple sessions for different locations
Blocked Content
Attack trying to access & download blocked content
Impossible Travel
Account accessed from geographically distinct location
Resource Consumption
Unusually high resource utilization
Resource Inaccessibility
Could indicate a ransomware attack
Out-of-cycle Logging
Logs contain actions & activities that should normally not be present
Missing Logs
Logs deleted without any authorized reason
Published or Documented Attack
Researcher publishes article on compromised company