# Do attackers come back after we clean up?

They try, if they kept a way in: stolen passwords, a forgotten remote-access tool, a new account, a scheduled task or a VPN that was never patched. Some criminals also sell or pass on access, so a second attack can come from someone else using the same door. After an incident, reset every credential that may have been exposed, service accounts included, remove remote-access tools nobody approved, close the way in, rebuild affected machines from known-good images and watch the network closely for weeks. Renewed connections to the attacker's servers are a typical sign; NetSenX flags command-and-control beaconing on every plan, Free included, and the indicators in your incident report can be searched for in your firewall and DNS logs.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/do-attackers-come-back-after-cleanup

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is incident response?](https://netsenx.com/en/faq/what-is-incident-response)
- [What are the phases of incident response?](https://netsenx.com/en/faq/what-are-the-phases-of-incident-response)
- [How do we prepare for a cyber incident before it happens?](https://netsenx.com/en/faq/how-to-prepare-for-a-cyber-incident)
- [What should an incident response plan contain?](https://netsenx.com/en/faq/what-should-an-incident-response-plan-contain)
- [Who should be on the incident team in a small company?](https://netsenx.com/en/faq/who-belongs-on-a-small-company-incident-team)