Rules wise??
You only have a chance to spot a hacker when he successfully attack one of your icons (I like to imagine that the attack it self will will look spectacular and forceful - but that you need to take a perception test to actually locate the offending persona unless it is not running silent and is within 100 meters) and you will automatically spot a hacker when he fail to sleaze one of your icons (I like to think that sleaze actions normally look very stealthy and blend in, but when failed will lit up the offender like a Christmas tree with sirens and spot lights and whatnot - no matter where how "far" away in the matrix they are).