How should security teams detect email account compromise when attackers use legitimate domains and no malicious links?

Security teams should look beyond payload scanning and focus on behavioral signals that suggest account takeover. A legitimate-looking message from a trusted domain can still indicate compromise if it arrives from an unusual sender path, shows mailbox access anomalies, or triggers lateral phishing from an internal account. Detection should correlate identity risk, message context, and downstream activity across email and cloud access.

Detecting account takeover when the sender looks legitimate

The first shift is to stop treating the domain as the trust signal. A message from a known domain can still be malicious if the account behind it is compromised, so detection has to move from content inspection to identity-aware correlation. Watch for unusual sender paths, impossible mailbox activity, abnormal forwarding rules, and internal propagation from a trusted account.

That means the alert should be driven by the account’s behaviour, not by whether the email contains a link or attachment. If the message arrives through a normal corporate domain but the authentication pattern, mailbox access pattern, or subsequent reply behaviour is out of profile, the event deserves investigation as possible takeover rather than ordinary business mail.

What signals matter more than payload scanning

Focus on signals that attackers cannot easily fake at scale: atypical login geography or device posture, new OAuth consent or forwarding settings, unfamiliar mail client usage, and bursts of outbound mail to internal recipients. A compromised mailbox often becomes visible only after it starts generating lateral phishing, reply-chain abuse, or access to other cloud services tied to the same account.

Correlation is the key control. Mail telemetry on its own is often too shallow, while identity telemetry without message context misses the attack path. Teams should join email logs, IdP events, cloud sign-ins, and mailbox rule changes so they can distinguish a trusted sender from a trusted but stolen account. For threat-path mapping, MITRE ATT&CK Enterprise Matrix is useful for framing credential access, lateral movement, and phishing abuse as one chain.

When compromise is suspected, compare the current behaviour with the user’s normal communication graph. The question is not only “was there a malicious link?” but “did this account begin acting like an attacker-controlled relay?” That is the moment when a legitimate domain becomes an indicator of abuse rather than reassurance.

How to separate benign business mail from compromise

Use a layered decision rule. If the sender is external but trusted, yet the origin path, mailbox state, or downstream activity diverges from baseline, treat it as a possible takeover. If the message prompts credential capture, internal forwarding, or secondary email bursts from the same account, escalate quickly because the account itself may now be the payload.

Teams that already monitor account and access anomalies should make sure email detections feed into the same queue as cloud identity alerts. That is especially important when the initial delivery looks clean, because the compromise often becomes obvious only after the attacker uses the mailbox to reset passwords, approve sessions, or seed replies inside the organisation. Baseline account-control guidance in CIS Controls v8 is relevant here, especially where account management and logging need to support investigation.

Risk and Threat Considerations

Legitimate-domain compromise is dangerous because it bypasses the visual cues people and filters rely on most. Once an attacker controls a real mailbox, they inherit trust, conversation history, and often access to internal systems that accept email as a low-friction authentication or recovery channel.

Failure mechanism: A stolen mailbox can generate normal-looking traffic while using the victim’s reputation to distribute phishing, reset credentials, or move laterally through reply chains and cloud-connected services.

Impact: Detection delay increases the blast radius, because the compromise can spread through trusted relationships before any malicious payload is observed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1566 — Phishing	Trusted-domain phishing and reply-chain abuse are core detection paths.
	T1078 — Valid Accounts	Compromised mailboxes use legitimate accounts to evade payload-based detection.
	T1114 — Email Collection	Mailbox access and forwarding-rule abuse are central compromise indicators.
Recommendation — Map email takeover to phishing techniques and hunt for follow-on abuse in identity telemetry. Treat suspicious trusted-domain mail as valid-account abuse until the account is verified. Correlate mailbox access and forwarding-rule changes with email delivery anomalies.
NIST SP 800-53 Rev 5	AU-6 — Audit Record Review, Analysis, and Reporting	Mailbox and identity events must be correlated to detect compromise beyond content scanning.
	IA-5 — Authenticator Management	Compromised mailboxes often expose reusable credentials, tokens, or sessions.
Recommendation — Review correlated audit events from email and identity systems for takeover patterns. Rotate or revoke credentials and sessions tied to the suspected account immediately.
CIS Controls v8	CIS-8 — Audit Log Management	Detection depends on joining mailbox, sign-in, and rule-change telemetry.
	CIS-6 — Access Control Management	Containment requires rapid revocation of compromised mailbox access paths.
Recommendation — Centralise email and identity logs so takeover signals can be correlated quickly. Revoke suspicious access paths and enforce least privilege for exposed accounts.

Practitioner Guidance

What to verify: Confirm that your detections correlate mailbox access, authentication events, forwarding-rule changes, and internal reply activity. If your SOC only sees message content, it will miss the takeover signal in cases where the attacker uses a clean domain and no obvious lure.

Decision rule: If an account shows credible access anomalies and then sends trusted-looking mail, treat the mailbox as compromised until proven otherwise. Prioritise containment, session revocation, and investigation of downstream messages before spending time on link reputation or attachment detonation.

Practitioner takeaway: The most reliable indicator is not what the email contains, but whether the sender’s behaviour fits the identity that claims to own the mailbox.