It is tricky. Monitoring network traffic should be enough, the infected device has to connect to Command and Control, to receive orders and set up tunnels. It got harder after malware creators started using Telegram, Discord or even good old IRC for those purposes - it will be asy to notice only if they use a service no one else uses in your network.