How to prepare for Living Off the Land (LotL) attacks

To go undetected, attackers can operate in your network without any malware at all. How to detect them and prevent damage?