Scanning for open network shares that users have haphazardly enabled Monitoring system activity during a suspected intrusion or malware infection Analyzing TCP sessions to determine who's talking to ...