A. A network share is repeatedly accessed during and after an infection indicating a more targeted attack.

B. A server in the DMZ that was repeatedly accessed outside of normal business hours on the weekend.

C. An external website that was the source of many malicious files.

D. An intranet website that is experiencing an increase in traffic from endpoints in a smaller branch office.

E. A malicious file that was repeatedly downloaded by a Trojan or downloader that infected multiple endpoints.