So you don't have an IDS or IPS?
(Intrusion Detection/Prevention System)
I would set that up on any decent business network I get my hands on.
Edit: Usually you can see something on the logs, And also check for strange processes on the machine.
Or anything basically out of place.
In the Garden of Eden sat Adam,
Massaging the bust of his madam,
He chuckled with mirth,
For he knew that on earth,
There were only two boobs and he had 'em.