Threat hunting

Hi,

Hunt: Beacon activity from legitimate processes
Mitre attack mapping T1071.001

I am looking to run a threat hunt

What questions/ queries to run?

https://attack.mitre.org/techniques/T1071/001/