Exim

You need to audit your outbound TCP port 25 connections, but you have to look contextually.

Specifically, hunt for port 25 traffic originating from processes that are not your actual authorized mail transfer agents like Postfix or Exim.

Got it.

If a process named Oramon is suddenly routing SMTP traffic to the internet, you have a critical compromise on your hands.