For fileless maleware you would need AMP on the clients , IPS could perhaps detect some patterns.

and for https/tls transport you would need ETA.