Comment by distracted_boy

Well if you are uploading GBs upon Gbs, maybe even TBs to malicioussomething.com or google.com, you know something's up. That's the first indicator. Next is to track what processes are responsible for the connection and go from there.