Security – What are the warning signs that a 51% attack is taking place or is about to happen?

I understand that this depends heavily on the method of attack. The two most likely scenarios that I can see are:

Scenario 1] New mining equipment totaling> 50% of online hashing performance to launch an attack of 51%.
This seems unlikely, as it would be difficult and costly to buy the necessary equipment and successfully hide it all.

or

Scenario 2] Existing mine pools totaling> 50% of the hashing force begin with an attack.
This could be due to state coercion, criminal intent, or mining mines.

Does anyone have any thoughts on what the observable warning signs of these attacks would be? For example: Scenario 2 could be preceded by a large drop in the hash rate of> 50% in the Bitcoin network. This would mean that half of the mine network started mining blocks in a parallel chain.