Add a 'DGA' (Domain Generation Algorithms) and other suspious domain alerting. For example, if a user visits

c81358859121583b7adf2ace89cb39f44(com), or another that's tied to possible C2 infrastructure. The key here is finding anomalous domains that are large, excessively random, or fit a pttern of suspicious activity before they're reported.