What Are the First Signs That a Business Might Be Under a Cyberattack?

I've been reading about ransomware and data breaches recently, and one thing I'm curious about is how businesses identify an attack before it causes major damage.

Apart from obvious signs like systems going offline, what early indicators do you usually look for?

For example:

Unusual login attempts?
Unexpected outbound traffic?
Suspicious emails?
High CPU or server usage?
Unknown user accounts?

I'd love to hear what security professionals or server admins monitor first and which tools have been the most helpful in detecting threats early.