I think the obvious thing would be to look for Internet activity on the machine. E.g., recent files for popular sites in a browser cache directory. Or live network traffic for public netblocks.
But it has to start out on machines connected to the public internet before spreading to the secret facility via USB drive. If it didn't spread when connected to the Internet, it wouldn't work. And it already doesn't blow up centrifuges when it's not on the target network.
