ojava
Start free trial

Step-by-step guides

What to do after each Ojava alert: what happened, how serious it is, the exact steps in Microsoft 365, Google Workspace or Windows, and when to call your IT provider.

  • Email protection of your domain got weaker

    The SPF or DMARC record of your email domain was removed or weakened. These records tell other mail servers which emails really come from you; without them, anyone can send emails that look like yours (fake invoices, changed bank details).

    Microsoft 365 · Google Workspace

  • Sign-ins from two places too far apart

    The same account signed in from two places that nobody can travel between in that time. Usually someone else has the password.

    Microsoft 365 · Google Workspace

  • Repeated failed 2-step checks

    Someone typed the right password but failed the second step many times. The password is probably known to an attacker; only the second step stopped them.

    Microsoft 365 · Google Workspace

  • Mail forwarded outside the company

    A rule or setting now sends this person's mail to an outside address. Attackers do this to read invoices and payment emails and to reply as the person.

    Microsoft 365 · Google Workspace

  • Admin rights given to someone

    Someone received an admin role. With it they can change everything in your Microsoft 365 or Google Workspace, including other people's passwords.

    Microsoft 365 · Google Workspace

  • An app was allowed to read mail or files

    Someone allowed an outside app to read or send mail, or to read files. Malicious apps use this to copy everything without a password.

    Microsoft 365 · Google Workspace

  • Someone is guessing a password

    Many wrong passwords were tried on one account in a short time. As long as 2-step verification is on, the account is usually safe; a weak or reused password makes it urgent.

    Microsoft 365 · Google Workspace

  • Many files downloaded at once

    One account downloaded an unusual number of files in a short time. It can be legitimate (a new laptop), or someone copying your data.

    Microsoft 365 · Google Workspace

  • A new 2-step method was added

    A phone, app or key was added to an account's 2-step verification. Normal when someone sets up a new phone; dangerous when someone else did it, or right after a sign-in from a new country: an attacker keeps access this way.

    Microsoft 365 · Google Workspace

  • Someone was given access to a mailbox

    A person (or an outside address) can now open another person's mailbox or send as them. Assistants need this; attackers use it to read and send mail unseen.

    Microsoft 365 · Google Workspace

  • A mail rule hides messages

    A rule deletes, marks as read or moves messages to a folder nobody opens. Attackers hide replies from clients or warnings from the bank this way.

    Microsoft 365 · Google Workspace

  • Many files shared outside the company

    One person shared many files with outside addresses or made them public within an hour. It can be a project, or someone taking your data.

    Microsoft 365 · Google Workspace

  • A stolen sign-in session

    The account was used from a rented server or from two countries in the same session. Phishing sites copy the session after the person signs in, which also gets past 2-step verification.

    Microsoft 365 · Google Workspace

  • An account is being taken over

    Several signs came together: a sign-in from a new country followed by a new 2-step method, a mail rule, mailbox access or mass sharing. This is how attackers secure a stolen account before they use it for fraud.

    Microsoft 365 · Google Workspace

  • Sign-in from an unusual country

    Someone signed in from a country your team doesn't usually sign in from. Often a trip; sometimes a stolen password. Travel? Use “I’m travelling” in Ojava so these sign-ins get a lower priority.

    Microsoft 365 · Google Workspace

  • Password guessing on a PC

    Many wrong Windows passwords were tried on this PC. Someone at the keyboard, or a program on the network, is trying to get in.

    Windows PC

  • A Windows tool was used to fetch or run code

    A built-in Windows tool (PowerShell or similar) downloaded or ran code in a way typical of attacks. It often follows a malicious email attachment or link.

    Windows PC

  • Windows Defender switched off

    The PC's antivirus protection is off. Attackers turn it off first; sometimes another antivirus or a setting did it.

    Windows PC

  • Windows Firewall switched off

    The PC's firewall is off, so programs on the network can reach it directly.

    Windows PC

  • A program set to start by itself

    A new startup entry, scheduled task or service was created. Software installs do this too; attackers use it to come back after a restart.

    Windows PC

  • Ransomware-like activity

    Many files were changed, renamed or deleted very fast, backups were deleted, or a hidden decoy file placed by Ojava was changed. This is how ransomware encrypts files before asking for money.

    Windows PC

  • A known malicious program or connection

    A program known to be used in attacks ran, or the PC connected to an address known to be used by attackers.

    Windows PC

  • USB storage connected

    A USB stick or disk was connected. Usually harmless; it can bring in malware or carry data out.

    Windows PC

  • A tool tried to steal Windows passwords

    A program read the part of Windows that holds passwords. Attackers do this to move from one PC to the others.

    Windows PC

  • Security logging switched off

    Windows' security records were switched off or cleared, sometimes followed by data leaving the PC. Attackers erase their tracks this way.

    Windows PC

  • Someone inside may be taking data

    Ojava saw a combination of signs (protection off, USB storage, many files copied) that fits someone taking data. Talk to the person before drawing conclusions.

    Windows PC