Normally, an attack is observed and analysed forensically over a longer period of time before an APT incident is cleaned. Here, the purpose of cleaning is to identify all the access paths, tools and methods in use. If the attacker notices that they have been discovered during this phase, they might take countermeasures. They may, for example, try to cover their tracks or sabotage additional IT systems. They may also abort the attack for the time being or set up more backdoors to continue the attack later.

Since it must be assumed that the entire IT infrastructure of the organisation in question has been compromised by an APT attack, the risk is high that the attacker will detect cleaning activities. This is particularly applicable if the compromised IT infrastructure is used to plan and coordinate the cleaning process. If essential steps for cleaning are not performed in the correct order or critical safeguards are not performed simultaneously in a coordinated manner, this will increase the risk of the attacker being alerted. If the persons in charge isolate the network in a step-by-step manner instead of all at once, for example, the attacker may be warned before their access is terminated effectively.