In my opinion policies will save you. Learn how to recognize packets and unnatural traffic and write policies to block them. For reference there is a book from 2004 I believe that shows some very basic triggers, it's called Hacking Exposed 3rd edition (I think). It's a great take on older malware and the thought processes.