In my experience, once an attacker is tipped off to a response, a few things can happen. What happens likely depends on where they are in their mission, mission priority, tolerance for being publicly identified, etc. It also likely depends on how badly they think they're burned.
A victim identifying a phishing doc or phishing backdoor doesn't necessarily mean the op is blown. In fact, it may give the victim a false confidence if they found the initial infection but didn't follow lateral movement. Same if an attacker loses a couple of implants out of many
However, trying to remove large numbers of implants and missing some, CURLing all of their C2 from your network, uploading several post-exploit backdoor samples to VT, discussing the intrusion in email, etc. - those are things that are more likely to elicit a response.
If the attacker wants to maintain access, they'll likely change toolsets and infrastructure. This may mean a new backdoor family or they may move to web shells, tunnelers, using legit creds for VPN/Citrix/cloud services, etc. They may leave their burned tooling or remove it.
The attacker may also go for spray and pray - deploying so much malware that the victim can't keep up, thus buying time to complete the mission. This may require more labor, but doesn't require much depth of tooling. This is a good tactic for smash and grab operations.
The attacker may do both, as in the incident we discussed in #noeasybreach - deploying new and stealthy malware while also mass-deploying known backdoors.
Of course, the attacker may pack up and leave, if they have already completed their mission, or if they are very sensitive to being identified or averse to exposing TTPs. Never assume this is the case until you've run down every lead.
In addition to maintaining OPSEC, it is also important to fully scope an incident before attempting remediation. Once an attacker has had time to move laterally, it is too late to play whack-a-mole. Remove attacker access, reset passwords, and address infection vector in one move
See this thread from @cglyer for more remediation thoughts and examples of stalling attackers without tipping your hand.
