Some simple examples...

Looking for kind 9734 that is created by a pubkey that has no posts or profile

Or kind 5 referencing events that never existed to begin with

Or kind 7 using non typical comments

Amounts and comments can make for publicly available messaging to C&C with no direct encrypted between participants necessary. A form of steganography through use of the protocol. Look normal, hide in plain site

A thorough data analytics for this will need multiple clients connecting to each known relay and comparing results. Some may even seek to form relationships directly with relays, paying them for direct feeds