Looking for privileged credential reuse on the network is the most likely process that would expose an attacker. The anomalous external files on the server suggest that the attacker gained access to the system. Therefore, the attacker must have had privileged credentials or access that allowed them to upload the files. By looking for privileged credential reuse on the network, the administrator can identify any credentials that have been compromised and potentially used by the attacker to gain access to the system. This information can be used to revoke compromised credentials, change passwords, and implement additional security measures to prevent future attacks.