Our antivirus shows everything green. Can we still be compromised?
Yes. Antivirus and endpoint tools look for known malicious files and suspicious behaviour on the machine, and they can only report from machines where they are installed and running. Attackers who log in with a stolen password and use the administration tools already present give them little to flag, and a printer, camera or server without the agent reports nothing at all. A tool that was switched off may also look quiet rather than red. Check which machines actually report to the console, when each last checked in, and whether any have been silent for days. Then add a second, independent view: the network. On the segments it monitors, NetSenX watches behaviour that crosses it, such as beaconing to a new outside server, scanning, new sessions between hosts and unusual uploads, on every plan, Free included, whether or not a host runs any agent.
Read next
Related questions
- An administrator account appeared that nobody remembers creating. What now?
- A server sends data out at night. What should we check?
- Our public IP address is on a blocklist. Does that mean we have been hacked?
- A colleague says the mouse moved by itself. Is someone controlling the computer?
- How do we check a suspicious computer without tipping off the attacker?