## Firewall Logs

Usually very simple but high volume.
*   `ALLOW TCP 192.168.1.5:54332 -> 8.8.8.8:53`
*   `DENY TCP 1.2.3.4:445 -> 192.168.1.1:445`

### Indicators
1.  **Outbound DENY**: Internal host trying to reach a blocked service (e.g., Malware trying to connect to C2 on port 6667 IRC).
2.  **Internal Scanning**: One internal IP connecting to 445 on ALL other IPs. (Lateral Movement / Worm).
3.  **Beaconing**: Regular connections to the same external IP every 60 seconds. (C2 Heartbeat).