Are current security monitoring systems - and I suppose a company like MS would be using state-of-the-art - not yet capable of detecting such anomalous behavior

Are current security monitoring systems - and I suppose a company like MS would be using state-of-the-art - not yet capable of detecting such anomalous behavior? A user gained root access, tried to access another internal IP address, tested multiple ports. I assume all these get logged at the kernel / hypervisor / firewall level...