5 MDR Detection Use Cases That Matter for Professional Services Firms

Read the complete guide: How do you make your IT cyber-insurance defensible? A 2026 guide for commercial businesses.

Managed detection and response (MDR) is often sold as a single feature: someone watches your network. For a 10-to-50 person law firm, accounting practice, or consulting group deciding whether the line item is worth it, that framing is too vague to evaluate. The useful question is narrower. What specific attacks is an MDR service actually there to catch, and do those attacks match the way small professional services firms are targeted? Below are the five detection use cases that carry the most weight for firms in this size range, each mapped to the relevant technique in the MITRE ATT&CK framework so the value is concrete rather than marketing.

Use case 1: Business email compromise and malicious inbox rules

The most common serious incident at a small professional services firm is not ransomware. It is a compromised mailbox. An attacker phishes a credential, signs into a Microsoft 365 or Google Workspace account, and quietly creates an inbox rule that forwards or hides messages. The goal is usually financial: intercept an invoice, alter wire instructions, or impersonate a partner to redirect a client payment. MITRE ATT&CK tracks this as Email Collection (T1114), with the auto-forwarding variant as T1114.003.

The FBI's Internet Crime Complaint Center has repeatedly ranked business email compromise among the costliest categories of cybercrime year over year. Firms that move client money, which describes most law and accounting practices, are prime targets. MDR catches this by watching identity and mailbox telemetry: an unusual sign-in immediately followed by a new forwarding rule is a high-fidelity signal that a mailbox has been taken over, and it triggers a response before the fraudulent wire goes out.

Use case 2: Anomalous authentication and stolen-session sign-ins

Multifactor authentication (MFA) is necessary, but attackers have adapted. Adversary-in-the-middle phishing kits now steal the session token after MFA is satisfied, letting the attacker replay a valid session without prompting for a second factor again. MITRE ATT&CK classifies the use of these credentials as Valid Accounts (T1078), one of the most common initial-access techniques because it looks like legitimate activity.

Detecting it requires correlation that a single tool rarely performs on its own: a sign-in from a new country minutes after a sign-in from the office, a sudden change in device or user agent, or impossible-travel patterns. Microsoft's threat research has for several years reported identity-based attacks in the millions per day across its cloud, which is why MDR treats the identity layer, not just the endpoint, as a primary detection surface. For the difference between the tools that generate this telemetry and the service that acts on it, see What is the difference between MDR, SOC, EDR, and SIEM?

Use case 3: Ransomware precursors and living-off-the-land activity

By the time files are encrypting, detection has already failed. The detection use case that matters is the precursor activity during the dwell period before encryption: credential dumping, lateral movement, and abuse of built-in Windows tools such as PowerShell (T1059.001) and Windows Management Instrumentation. Attackers favor these "living-off-the-land" techniques precisely because they blend into normal administration and leave no new file for antivirus to flag.

CISA's #StopRansomware guidance emphasizes detecting and interrupting this pre-encryption phase. MDR earns its cost here by recognizing the behavioral chain, an unusual PowerShell command spawning from an office application, a service account authenticating to systems it never touches, and isolating the affected host while the attack is still contained to one machine rather than the whole file server.

Use case 4: Client-document staging and exfiltration

Professional services firms hold concentrated, high-value data: case files, financial records, deal documents, and personally identifiable client information. Modern attacks increasingly steal that data before any encryption, so the firm faces extortion even from a clean backup. MITRE ATT&CK tracks the theft as Exfiltration Over Web Service (T1567), typically to a cloud storage provider that looks like ordinary traffic.

The detection signals are behavioral: a workstation suddenly reading large volumes from a document management repository, an unusual archive being created, or a spike in outbound transfer to an external destination. Verizon's annual Data Breach Investigations Report has consistently documented that data theft and extortion now accompany a large share of intrusions. MDR flags the staging step, giving the firm a chance to cut the transfer off before the data leaves.

Use case 5: Endpoint tampering and unauthorized persistence

Once inside, an attacker works to stay inside and to blind the defender. That means disabling or modifying security tools (T1562.001) and establishing persistence by creating new accounts or manipulating existing ones (T1098 and related account-manipulation techniques). A new local administrator account appearing overnight, security tooling being switched off, or a scheduled task added for reboot survival are all detection events.

These signals are quiet by design, which is exactly why an unstaffed alert queue misses them. MDR's value is that a human analyst treats "endpoint protection was disabled at 3:14 a.m." as an incident to investigate immediately, not a log line to review next quarter. That around-the-clock human triage is the real dividing line between a service that protects a firm and a tool that merely records what happened. We covered that distinction in Is your MDR provider actually watching, or just logging?

What these five have in common

Four of the five use cases above are invisible to traditional antivirus, and three of them live in the identity layer rather than on the endpoint. That is the core reason a small firm cannot detect its way to safety with a tool alone. The tool produces the telemetry; a staffed team correlates it, decides what is real, and takes containment action within minutes at any hour. If you are evaluating what the first weeks of that service actually look like in practice, read What happens in the first 60 days with a new MDR?

Frequently asked questions

Does a 15-person firm really need MDR, or is antivirus enough?

Antivirus and even endpoint detection and response (EDR) generate alerts, but a small firm has no one watching those alerts at 2 a.m. MDR adds a staffed team that triages and acts on alerts around the clock. The two detection use cases that matter most for small professional services firms, business email compromise and stolen-session sign-ins, are identity events that antivirus does not see at all. The gap is not detection capability; it is who is watching and who responds.

How is MDR different from just having EDR on our computers?

EDR is a tool that runs on endpoints and produces telemetry and alerts. MDR is a service: analysts monitor endpoint and identity telemetry continuously, separate real incidents from noise, and take containment action such as isolating a device or disabling an account. A firm without dedicated security staff gets little value from EDR alerts that no one reviews. MDR supplies the human layer that turns telemetry into response.

What is the single most common threat MDR catches at a small professional services firm?

Business email compromise and the malicious inbox rules that follow a mailbox takeover. Professional services firms are frequent targets because they routinely handle client funds, wire instructions, and trust accounts. Detecting the anomalous sign-in and the auto-forwarding rule early is often the difference between a contained incident and a fraudulent wire.

For the full picture of how detection fits alongside the other controls underwriters expect, read the pillar guide on cyber-insurance defensible IT.