1. A computer-implemented method comprising: installing, using a computer processor, on one or more computing devices, at least one benign malware indicator resembling a piece of evidence resulting from a genuine malware infection; monitoring, using the computer processor, the one or more computing devices for the at least one benign malware indicator; and responsive to determining that the at least one benign malware indicator is no longer detected as present on at least one of the one or more computing devices, sending a notification, using the computer processor, indicating that the at least one benign malware indicator is no longer detected as present on the at least one of the one or more computing devices.