So...malware isn't that simple. Network honeypots can work for that but malicious apps or remote exploit that require specifics apps/services running under the target's account would not be easy to catch this way.

APTs are not exactly a new thing. On windows you get endpoint security software that logs excessive telemetry to a place threat hunters of security companies can search to find exploitation or infection attempts.