Do attackers come back after we clean up?
They try, if they kept a way in: stolen passwords, a forgotten remote-access tool, a new account, a scheduled task or a VPN that was never patched. Some criminals also sell or pass on access, so a second attack can come from someone else using the same door. After an incident, reset every credential that may have been exposed, service accounts included, remove remote-access tools nobody approved, close the way in, rebuild affected machines from known-good images and watch the network closely for weeks. Renewed connections to the attacker's servers are a typical sign; NetSenX flags command-and-control beaconing on every plan, Free included, and the indicators in your incident report can be searched for in your firewall and DNS logs.