I gave the example of syncing plugins. If you run any game with anti-cheat (which is many) most will have process monitoring. Endpoint tools can also monitor.

I gave the example of syncing plugins. If you run any game with anti-cheat (which is many) most will have process monitoring. Endpoint tools can also monitor. In the past (I'm not current) you could look at connections using self signed SSL certificates on network, so network monitoring tools could be used to pick up folks pushing tor traffic over your network. You could also watch for folks connecting to tor exit nodes (this used to be public info).