# Do attackers leave anything behind after we rebuild our machines?

Sometimes, because a rebuild only cleans the machines you rebuilt. What survives is usually somewhere else: passwords and session tokens the attacker stole, accounts they created in the directory or in cloud services, a remote-access tool on a server nobody reimaged, scheduled scripts on a file share, changed firewall rules, or a backup that already contained their tools. Before you call an incident closed, reset every credential that may have been exposed, review new accounts, mail forwarding rules and remote-access software everywhere, compare firewall and VPN settings with a known-good copy, and restore only from backups taken before the intrusion. Then watch closely for several weeks. Renewed connections to the attacker's servers are a typical sign of something missed; NetSenX flags command-and-control beaconing on every plan, Free included.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/do-attackers-leave-traces-after-a-rebuild

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [Can we check our company network for botnet infections for free?](https://netsenx.com/en/faq/can-we-check-for-botnet-infections-for-free)
- [What is a compromise assessment, and do we need one?](https://netsenx.com/en/faq/what-is-a-compromise-assessment)
- [A company in our sector was hacked. How do we check whether we are next?](https://netsenx.com/en/faq/a-company-in-our-sector-was-hacked-are-we-next)
- [What should we look for on our network after a partner or peer company is breached?](https://netsenx.com/en/faq/what-to-look-for-after-a-partner-company-is-breached)
- [We had an incident last year. How do we make sure we would detect it if it happened again?](https://netsenx.com/en/faq/how-to-detect-a-repeat-of-last-years-incident)