This is a really complex problem, and continually moving. One of the better methods for finding this traffic is to run some kind of ids system on your egress traffic to identify which systems may be doing suspicious things. This will allow you to react proactively. It takes a lot of skill to tune these so they return relevant results, but it can be done; though it is a lot like whack-a-mole.
If you don't have access to your external traffic feed other than on the systems that generate them, third party products do exist to scan systems and traffic for suspicious activity. Some of the major AV vendors have system that can scan even Linux systems for this kind of thing. It's signature-based for the most part so it'll be known threats, but that's better than nothing.