What free checks can I run today?
Export the top outbound destinations from your firewall or DNS server and look at the rare ones; review successful sign-ins outside business hours; count how many internal hosts each workstation contacts on SMB, RDP, SSH and WinRM ports; and compare each server's outbound volume with its own average.
This answer also appears, with more context, here: Is someone inside your network?