@Abhi my suggestion would be to write splunk queries to isolate events that you would consider suspicious on your network. Most folks use the mitre framework these days as a reference: https://attack.mitre.org/wiki/Technique_Matrix many of these techniques can be observed using osquery. For example, attackers/malware sometimes create scheduled tasks for persistence — you can use osquery to enumerate scheduled tasks and splunk to set up an alert when a new scheduled task gets added