Moorfox
How do I check if a Windows PC has been hacked?
Look for remote access tools the client did not install (AnyDesk, TeamViewer, ScreenConnect and the like) and whether RDP was switched on, then new accounts with Get-LocalUser and Get-LocalGroupMember Administrators, then anything that survives a reboot with Autoruns and Get-ScheduledTask, then Defender exclusions with Get-MpPreference, then netstat -abno, and finally the user's Microsoft 365 sign-ins and inbox rules.
If there is any sign of active remote control or ransomware, pull the network first but leave the machine powered on, and do not wipe it before you know how it happened. When you find something and cannot be sure what else was installed, reimage rather than clean.
A machine lands on your bench because the user clicked something, the bank flagged a payment, or the client says it feels wrong. This is the checklist for ordinary business PCs, in the order that finds the common cases first. It is not forensics for a courtroom; it is how to find out what happened and stop it from happening to the next machine.
Before touching anything: if there is any sign of active remote control or ransomware, disconnect the network (pull the cable or turn off Wi-Fi) but do not power off. Do not wipe the machine before you know what happened. Take notes with times.
Step 1: remote access tools the client did not install
The most common compromise on a business PC does not involve malware. A support scam or phishing chain ends with a legitimate remote tool installed: AnyDesk, TeamViewer, ScreenConnect, UltraViewer, Splashtop, RustDesk, or Quick Assist. Defender has no reason to object to any of them.
Check Settings > Apps, Get-Package, the Uninstall registry keys, and running processes. Then check whether RDP was turned on: the value fDenyTSConnections under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server is 0 when RDP is enabled. Check Windows Firewall for new inbound allow rules. Uninstall what should not be there, turn RDP back off, and delete the rules.
Step 2: accounts and the security log
Get-LocalUser and net user list local accounts; an attacker's account tends to be named to look like a system account. Get-LocalGroupMember Administrators shows who has admin. Then open the Security event log and look for these IDs:
- 4720: a user account was created
- 4732: a member was added to a local group
- 4624 with logon type 10: a remote interactive (RDP) logon
- 4625: a failed logon; hundreds in a row is password guessing
- 1102: the audit log was cleared, which is itself a strong sign
Remove the accounts and the group memberships. If you find 1102, assume whoever did this knew what they were doing and read the rest of the checklist with that in mind.
Step 3: anything that survives a reboot
Attackers need persistence, so check every entry that starts on boot or on a schedule. Run Autoruns from Sysinternals (Microsoft, free) and hide the Microsoft entries; the remaining list is what to read. Then run Get-ScheduledTask | Where-Object State -ne Disabled, use Get-ScheduledTaskInfo for creation dates, and check event ID 4698 (scheduled task created) in the Security log and 7045 (new service installed) in the System log. Finish with the Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run and the same path under HKCU, and the Startup folder.
Disable or delete what you find, but note the file paths first: they tell you where to look in the next two steps.
Step 4: Defender
Get-MpComputerStatus shows whether real-time protection is on and when signatures were last updated. Get-MpPreference | Select-Object -ExpandProperty ExclusionPath (and the same for ExclusionProcess and ExclusionExtension) lists exclusions; attackers add one for their folder. Windows Security > Protection history shows detections that were "allowed".
Turn real-time protection back on and remove exclusions you cannot account for. Run Start-MpScan -ScanType FullScan after the checks and not before, so the scan does not delete evidence you have not looked at.
Step 5: network settings and connections
Run netstat -abno from an elevated prompt to list connections with the owning process, and look for a process you do not recognise with an established connection. Check the hosts file at C:\Windows\System32\drivers\etc\hosts for added entries. Check the proxy in netsh winhttp show proxy and in Settings > Network > Proxy for a proxy the client never set, and the DNS servers in ipconfig /all against what the site should be using.
Remove added hosts entries, clear the proxy, and put the DNS servers back.
Step 6: the browser and the mailbox
Check the browser for extensions the user did not install, saved passwords, or sync turned on to an account the user does not recognise. If the machine signs into Microsoft 365, open the user's sign-in log in Entra and look for locations that are not theirs. Check the mailbox for inbox rules that forward or delete mail. A quiet forwarding rule is the classic sign of business email compromise, and it survives a reimage because it lives in the mailbox, not on the PC.
Reset the password and revoke sessions from a clean machine. Remove the rules and turn on MFA if it was not already.
What do I do when I find something?
Keep the machine off the network. Change the user's passwords from a different, clean machine, starting with email. Enable or check MFA. Tell the client plainly what you found. If any doubt remains about what was installed, reimage rather than clean, because a cleaned machine with an unknown backdoor is worse than a rebuilt one. Restore data from backup, not from the compromised disk, where you can.
What does not prove a hack: a slow machine, pop-ups from a legitimate program, or a browser home page changed by a bundled toolbar. That is junk software, still worth removing, but a different ticket.
With an agent already on the machine, most of this checklist runs from the remote terminal without a site visit, and the machine's audit trail shows who connected to it and when. Moorfox's security score flags RDP enabled, Defender off, missing patches and local admin accounts across the fleet, so the same check runs on every machine rather than one at a time.
Frequently asked questions
Should I wipe a hacked PC immediately?
Not before you know what happened, or the next machine goes the same way. Take the evidence and reset the passwords first. After that, if any doubt remains about what was installed, reimage rather than clean: a cleaned machine with an unknown backdoor is worse than a rebuilt one.
What is event ID 4624 with logon type 10?
A remote interactive logon, which on a workstation means someone connected over RDP. Pair it with 4625 (failed logon); hundreds of those in a row are password guessing.
Is a full Defender scan enough?
No. Defender does not flag AnyDesk, a new admin account or an inbox forwarding rule, because none of them is malware. Run the scan, but after the checks above, so it does not remove evidence before you have looked at it.
How do I tell if the Microsoft 365 account is compromised too?
Check the user's sign-in log in Entra for locations that are not theirs, and the mailbox for inbox rules that forward or delete mail. Reset the password and revoke sessions from a clean machine, not the suspect one.
What should I do if I find active remote control or ransomware?
Pull the network cable or turn off Wi-Fi, but leave the machine powered on, and start writing down times. Do not wipe anything yet.