A host-level artifact is any file, configuration change, running process, or log entry left on a computer that can indicate compromise or help an attacker maintain access. Examples include an unexpected SSH key in authorized_keys, a modified service setting, a suspicious scheduled task, or a reverse-tunnel process.
These artifacts matter because they can reveal what happened on a device and whether access may persist after malicious software is removed. Defenders investigate them during incident response, comparing files, settings, processes, and logs with known-good baselines. If compromise is suspected, removing an extension alone may not be sufficient: isolate the host, examine persistence locations, and rotate credentials from a trusted device.