Review Security Logs

Analyze firewall, intrusion detection/prevention system, and endpoint logs for suspicious activity that might indicate malware.