1Beaconing
Malware on a host checks in with the attacker's command-and-control (C2) server, often over ordinary web traffic (T1071.001) so it blends in. Beacons repeat on a schedule, every 60 seconds give or take a few, for example.
That regularity is the tell. People browse in bursts; software beacons like a clock. A destination nothing else in the network talks to, contacted at steady intervals, deserves a look.
2Spreading
From one foothold, attackers move to other machines. On Windows networks that is often over SMB admin shares (T1021.002) with stolen credentials. Then they set something to run again later, such as a scheduled task (T1053.005), so they survive reboots.
New connections between machines that have never talked before, followed by a new scheduled task, form a chain. Each event alone is easy to ignore; together they tell you what is happening.
3Respond in proportion
Isolating the first host stops the beacon. But if the attacker has already moved, the other hosts matter too. Scope first, then contain everything in scope, or the attacker simply uses the host you missed.