How about making this real simple? Close all unneeded outbound ports and regularly monitor traffic for unusual activity. Also, if user's base-line their operations and identify all legitimate business processes (ports, protocols, machines etc.) it greatly simplifies identifying anomalous behavior. Thirdly, restrict and monitor what users are doing on the Internet. Internal abuse and user mistakes are the single biggest source of problems. The makers of Bots are setting traps for these doofi (multiple doofuses) and sit back and wait for them to click in it.