Shiners
If you can’t see any telltale flow marks and the ceiling stain is fairly small, look at the underside of the roof for ‘shiners.’ A shiner is a nail that missed the framing member. Moisture that escapes into the cold attic from the rooms below often condenses on cold nails.
Sometimes you can spot this if you climb up into your attic on a cold night. The nails will look white because they’re frosted. When the attic heats up a bit during the day, the frost melts and drips, then the nails frost up at night again and so on. The solution is to simply clip the nail with a side-cutting pliers.