You are concerned about rootkits on your network communicating with attackers outside your network. Without using an IDS how can you detect this sort of activity?

Domain controller logs record authentication events such as logins, logoffs, and policy changes, and do not capture general network traffic patterns indicative of rootkit command-and-control activity.

Firewall logs provide visibility into network-layer communication, making IDS a useful but not strictly required tool for detecting anomalous outbound traffic.

Firewall logs capture metadata for every connection attempt passing through the perimeter, including source IP, destination IP, port, and protocol. Rootkits must communicate outbound to reach an attacker's command-and-control server, and this traffic will appear in firewall logs as unusual outbound connections on unexpected ports or to suspicious external addresses. Reviewing these logs allows an analyst to identify covert channels without deploying a dedicated IDS.

Setting up a DMZ is a network segmentation strategy that separates public-facing servers from the internal network, but it does not provide detection capabilities for rootkit communications.