If a user reports any of the above symptoms, you should perform further investigation. An unusual signature was recently added, such as a fake banking signature or a prescription drug signature.The Sent or Deleted Items folders in Microsoft Outlook or Outlook on the web contain common hacked-account messages, such as 'Help! I need money!'.The user's mailbox is blocked from sending email.The user's display name might be changed in the Global Address List.These rules may automatically forward emails to unknown addresses or move them to the Notes, Junk Email, or RSS Subscriptions folders. The presence of inbox rules that weren't created by the intended user or the administrator.Other users might receive emails from the compromised account without the corresponding email existing in the Sent Items folder of the sender.Suspicious activity, such as missing or deleted emails.

Users might notice and report unusual activity in their Office 365 mailboxes. When the attacker emails data to external recipients. One action commonly seen is the attacker sending emails as the original user to recipients both inside and outside of the organization. Using the stolen credentials, the attacker can access the user’s Office 365 mailbox, SharePoint folders, or files in the user's OneDrive. With them the attacker can sign in as the original user and perform illicit actions. When someone other than the intended user steals those credentials, the stolen credentials are considered compromised. Recommended Steps when a User's Account is Compromised Access to Office 365 mailboxes, data and other services, is controlled through the use of credentials.

Microsoft onedrive email hack