Command and control

Most intrusions need a channel back to the attacker, for instructions and for stolen data.

Finding that channel is often easier than finding the intrusion itself, because it has to be persistent and it has to leave. Beaconing at regular intervals, unusual destinations, traffic to newly registered domains. Egress control and outbound monitoring attack this directly, which is why they are worth more than their popularity suggests.