Adding to this, I've found `lsof -i` more useful for spotting suspicious activity - it shows processes listening on ports as well as established connections. En

Adding to this, I've found `lsof -i` more useful for spotting suspicious activity - it shows processes listening on ports as well as established connections. Enabling and checking cronjob logs is also something I wasn't doing before.