I have done traffic analysis (e.g. netflow) and some basic base-lining/anomaly detection/cross referencing to spot this. Things like "Why do 9,999 workstations

I have done traffic analysis (e.g. netflow) and some basic base-lining/anomaly detection/cross referencing to spot this. Things like "Why do 9,999 workstations send an average of X bytes of DNS traffic a day, but yesterday Bob sent 1024 * X bytes" and "99% of DNS traffic is to a set of X DNS servers (root servers, DHCP assigned ones), but Jane almost always sends it to this one rando DNS server" get pretty easy to spot. Not perfect by any stretch, but you spot a lot of egregious stuff. For production environments it's really unnecessary to allow most egress traffic, but it's especially unnecessary to allow DNS. Yeah...this is really the low hanging fruit for this issue.