# An employee entered their password on a phishing page. What should we check on the network?

Do the identity work first: reset the password, revoke sessions, check the sign-in log and the MFA methods. Then look at the network for signs that the login was used to go further. Useful questions: did the employee's device or account connect to servers it never normally uses, such as file servers, the domain controller or finance systems? Did remote-desktop or remote-management sessions start from an unusual machine? Did any device begin regular, timed connections to an unfamiliar outside address, which can mean a remote-control channel? Did unusually large amounts of data leave the network? In NetSenX, the alert history and the network map show these patterns on every plan: beaconing, internal scanning, lateral movement and unusual outbound data volumes. If none appear in the days after the click, that is reassuring but not proof, because cloud mailboxes and SaaS apps are reached over the internet and that activity never crosses your network.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/employee-entered-password-what-to-check-on-the-network

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [How do you clean a computer after a phishing click?](https://netsenx.com/en/faq/how-to-clean-a-device-after-a-phishing-click)
- [After a phishing click, how do attackers get from one laptop to the rest of the network?](https://netsenx.com/en/faq/how-attackers-move-from-a-phished-laptop-to-the-network)
- [Should employees report a phishing e-mail even if they did not click it?](https://netsenx.com/en/faq/should-employees-report-phishing-they-did-not-click)
- [Does security awareness training stop phishing?](https://netsenx.com/en/faq/does-security-awareness-training-stop-phishing)
- [What is spear phishing?](https://netsenx.com/en/faq/what-is-spear-phishing)