Account compromise has two halves, and Clicc watches both.
Entry watches - someone getting in
Pending access invite - the earliest signal, before access even exists.
New user / access change - a person gains access, or an admin role appears.
New manager link - an unfamiliar MCC gains bulk control.
All three run every 5 minutes against your trusted baseline.
Damage watches - what an intruder does inside
Critical setting change - budgets jacked up, targets shifted, campaigns paused.
Runaway spend - the money actually leaving.
Conversion tracking broke - tracking tampered with to hide the damage.
Example. A real takeover reads like a sequence: pending invite (5:02pm) → new admin user (5:20pm) → budget +400% (5:31pm) → runaway spend (6:15pm). Clicc emails at every step - you almost always act on the first one.