Activity Monitor can provide a fair bit of info.
I keep mine open at all times and occasionally check CPU usage when I'm online.
"Networking" shows what processes are open and operating; it can be useful when working online.
"CPU" should normally be relatively 'quiet', even when online; If it appears that there's exaggerated activity when things are otherwise 'quiet', there's a good chance that some sort of (potentially unauthorized) activity is being carried on and may be the first evidence of one's device being used as part of a botnet. At the very least it should provoke more detailed examination as to what's causing it.
