How to find what an operator left behind

A hunt rather than a response. The assumption that makes it work: an operator who spent effort getting in spent effort staying in, and left more than one way back because they expected to lose the first.

Trigger. You have evicted somebody, or believe you have, and need to be sure there is no way back in.

The first 150 minutes0 of 5 expire

01 02 03 04 05

075 min150

01
Start with identity, because it survives rebuilds
by 30 min
New or modified accounts, added authentication methods, API keys, service principals, consent grants and federation changes. Rebuilding every endpoint achieves nothing if the operator can sign in afterwards.
02
Then the autostart surface on hosts, exhaustively
by 90 min
Run keys, services, scheduled tasks, WMI subscriptions, startup folders and shell extensions on Windows; systemd units and timers, cron at every scope, profile files and authorised keys on Linux. Enumerate the surface rather than searching for known names.

Tell somebody

The identity team, because the highest-value persistence is usually theirs to remove
Whoever owns the network edge, on configuration changed during the window
Executive, if you find persistence after eviction was declared complete

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Start with identity, because it survives rebuilds

Then the autostart surface on hosts, exhaustively