There are various strategies. One way that is fairly common is to have canary files that, when modified, trigger alerts and other automated action (locking out

There are various strategies. One way that is fairly common is to have canary files that, when modified, trigger alerts and other automated action (locking out the account that did the modification, for instance).