Malicious modules are often loaded using require() on unexpected asset IDs.

Look for any unexpected or randomly named Script or ModuleScript objects [1].

Create hidden remote events or functions that allow the exploiter to run arbitrary server code.