We have had issues with compromised Exchange accounts sending out malicious e-mails via SMTP and OWA.
It seems that many of these accounts were compromised via incoming phishing attempts. We are currently deploying something to tighten our protection against those.
We now want to look into more proactive ways of detecting compromised accounts. Some non-hashed-out thoughts that came up:
- monitoring outgoing mail queue for suspicious activity
- checking for logins from foreign IP addresses in the IIS logs
- rate limiting logons (automatic lock of account?)
- rate limiting e-mail (automatic lock of account?)
If anyone has implemented something like this, any tips or products you used? How else have you tried to proactively detect compromised Exchange (or AD) accounts?