It depends on attack surface and what tooling you already have in place. But for example:

> Finding suspicious outbound network activity

https://blog.rapid7.com/2016/05/09/introduction-to-osquery-f...