How do you know the attacker is gone?

You never know with absolute certainty: you establish it through a body of evidence. The investigation reconstructs everything the attacker did and every way they got in, a coordinated eviction closes all of those routes at once, and enhanced monitoring then checks over an agreed period that no malicious activity returns. The outcome is expressed as a level of confidence.

This article is part of our series on how incident response unfolds. For the full picture, see How does incident response work?.

Why “we can’t see anything any more” is not enough

After containment, alerts often die down. That is reassuring, but misleading. A skilled attacker works hard to stay quiet: they use legitimate accounts, admin tools already on the network, remote access or forwarding rules in mailboxes. None of this necessarily triggers an antivirus alert.

Advisory AA20-245A from the US agency CISA and its partner agencies describes this trap. Blocking an IP address or deleting a file without understanding how it got there leaves the attacker free to change tactics and keep access. The same advisory warns against rushing credential resets, because the attacker may hold other credentials or forged authentication tickets.

Quiet tools are not proof. Proof comes from method.

The evidence responders look for

Evidence	What it establishes	How it is obtained
Entry point identified	We know how the attacker got in	Analysis of logs, endpoints and remote access
Full timeline	We know what they did, and since when	Correlating EDR, directory, email and firewall logs
Scope of the compromise	We know which machines, accounts and data were affected	Hunting for indicators of compromise across the estate
Persistence removed	Backdoors are closed	Review of created accounts, scheduled tasks, services, mailbox rules
Identities cleaned	Stolen secrets no longer work	Coordinated reset of exposed passwords and secrets
No recurrence	Nothing reappears after eviction	Enhanced monitoring over an agreed period

The stronger the evidence, the higher the confidence. Conversely, any blind spot (missing logs for a period, a server not analysed) must be flagged, because that is often where a forgotten foothold hides.

The subtle signs of a lingering presence are covered in 3 weak signals an EDR can’t see without a SOC.

Coordinated eviction: close everything at once

A common mistake is to shut each route as it is found. The attacker notices and falls back on access the team has not yet discovered. Good practice, as described by CISA, is to wait until the scope is sufficiently understood and then act in a coordinated way:

• remove all persistence mechanisms at the same time;
• reset exposed passwords, privileged and service accounts first;
• in an Active Directory environment, reset the krbtgt account twice, the second time after the first has replicated, as advisory AA20-245A recommends;
• block the attacker infrastructure that has been identified;
• fix the original weakness.

ANSSI, the French national cybersecurity agency, presents regaining control of the information system as a distinct remediation step in its guide on cyberattacks and remediation: something to plan and steer, not a string of isolated actions.

Enhanced monitoring after eviction

Once the eviction is done, the question becomes: is the attacker trying to get back in? For a period agreed with the provider, the team watches closely for:

• sign-ins to reset accounts and privileged accounts;
• sign-ins from unusual countries or addresses, particularly on Microsoft 365;
• the indicators of compromise found during the investigation;
• any new scheduled task, service or remote access tool.

This is exactly what a 24/7 SOC is for. At Cyna, the SOC is run from France by in-house teams and relies on SentinelOne or Microsoft Defender EDR plus Microsoft 365, Google Workspace, Stormshield and Fortinet connectors. The CERT shares the indicators found during the investigation with the SOC, and the length and scope of this monitoring are set out in the contract agreed with your partner MSP. See What happens when a managed SOC detects an attack?.

What the report should say

An incident report should never simply state “the attacker has gone”. It should set out the evidence gathered, the resulting level of confidence and any remaining uncertainty, together with the monitoring measures that offset it. Management uses this to decide when to close the incident and fully resume operations. See What does an incident report contain? and When can you restart production after a cyberattack?.

Talk to an expert

Want to check that a past incident is truly closed, or see how your SOC would spot an attacker trying to return? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Is a full antivirus scan enough to prove the attacker has gone?

No. An attacker can stay in without any malware at all, using legitimate accounts, remote access tools or mailbox rules. You need an investigation that reconstructs what they did, followed by behavioural monitoring. See Antivirus vs EDR.

Do we need to change every password?

Every password that may have been exposed, starting with privileged accounts, service accounts and technical secrets. Resets should be coordinated and done at the same time as the other eviction steps, otherwise the attacker can fall back on a forgotten credential.

What if the attacker comes back a few weeks later?

It is a real risk, especially if credentials were sold on or the original weakness was not fixed. That is why post-incident monitoring and the action plan matter. See How to prevent a second attack.

Who certifies that the attacker has gone?

The incident response provider gives a reasoned opinion, with a level of confidence and any remaining uncertainty. Management then decides to close the incident on that basis.