Do attackers leave anything behind after we rebuild our machines?

Sometimes, because a rebuild only cleans the machines you rebuilt. What survives is usually somewhere else: passwords and session tokens the attacker stole, accounts they created in the directory or in cloud services, a remote-access tool on a server nobody reimaged, scheduled scripts on a file share, changed firewall rules, or a backup that already contained their tools. Before you call an incident closed, reset every credential that may have been exposed, review new accounts, mail forwarding rules and remote-access software everywhere, compare firewall and VPN settings with a known-good copy, and restore only from backups taken before the intrusion. Then watch closely for several weeks. Renewed connections to the attacker's servers are a typical sign of something missed; NetSenX flags command-and-control beaconing on every plan, Free included.

← All 35 questions on Have I been hacked?All topics