Most malware isn't designed by the likes of NSA, Mossad, FSB, or PLA, so you get reports unusual/excessive processor/storage/network activity. The time between

Most malware isn't designed by the likes of NSA, Mossad, FSB, or PLA, so you get reports unusual/excessive processor/storage/network activity. The time between something new showing up on the wildlist and antivirus/middlebox vendors creating signatures is also pretty short, so most of the time it's the antivirus/middlebox itself alerting you. Also, malware with only regular user permissions can only do so much. This isn't like the good old days where everyone was logged into an administrator account or local privilege escalations were bountiful. Nowadays, you're stuck in an unprivileged login session that can't normally install a rootkit without giving yourself away via a UAC prompt.