Have you checked out the Anti-bot blade? This is a post-infection blade that should do what you want, however there is no direct way to add indicators/signatures to that blade specifically. You could however add a custom SNORT-based signature to the IPS blade if you are looking for something specific.
--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.
Attend my online "Be your Own TAC: Part Deux" CheckMates event
March 27th with sessions for both the EMEA and Americas time zones