Booting from a remote PXE server would very likely leave tons of evidence in the Router and Splunk logs. Even if they managed to Place a PXE server physically in the same network as the machines they took over, the command and control traffic would likely be in the logs as well.
Booting from a remote PXE server would very likely leave tons of evidence in the Router and Splunk logs. Even if they managed to Place a PXE server physically in the same network as the machines they took over, the command and control traffic would likely be in the logs as well.