# How do we check a suspicious computer without tipping off the attacker?

Observe before you act, and then act all at once. An attacker who notices you looking may delete evidence, move to another machine or start encryption early, so avoid noisy steps, such as resetting the user's password or running a full scan, before you have a plan. First collect what you can quietly: the endpoint console's history, firewall and DNS logs, and the connections the computer makes. Decide with your incident-response provider which accounts and hosts to contain, then do it together: isolate, reset credentials from a clean device and block the attacker's destinations within the same short window. Work from a clean device, and do not discuss the incident over a mailbox that may be compromised. A NetSenX sensor on a SPAN or TAP port observes without touching the computer, and its alerts list the destinations, timing and volume a containment plan needs.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/how-to-check-a-suspicious-computer-without-alerting-the-attacker

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [How do I know if my business network has been compromised?](https://netsenx.com/en/faq/how-do-i-know-if-my-business-network-has-been-compromised)
- [Can an attacker stay inside a network for years without being noticed?](https://netsenx.com/en/faq/can-an-attacker-stay-inside-a-network-for-years-without-being-noticed)
- [What free checks can I run today?](https://netsenx.com/en/faq/what-free-checks-can-i-run-today)
- [Does NetSenX replace antivirus or EDR?](https://netsenx.com/en/faq/does-netsenx-replace-antivirus-or-edr)
- [Can my small business be hacked without me knowing?](https://netsenx.com/en/faq/can-my-small-business-be-hacked-without-me-knowing)