On the appliance: run contentscannerstatus (need ≥25.3.0.5525) and grep "System Security" system_logs. Treat "Suspected compromise indicator was found" as confirmed compromise and follow Cisco's rebuild/TAC guidance—root access can erase local logs. Off-box, look for unexpected uploads/downloads from the SEG management or mail interfaces to unfamiliar IPs.

# Sigma-style sketch (network)
detection:
  selection:
    src_ip: <SEG_mgmt_or_mail_ip>
    dst_port: [22, 443, 4443, 8080, 8443]
  filter:
    dst_ip|cidr: ['<known_update_cdn>', '<corp_ranges>']
  condition: selection and not filter

Also inventory File Reputation enabled policies. Sketch only; validate before alerting.