Also, I'd argue, there's still a wide gap in knowledge requirement, as well as ease of use between LS and some homebrew tcpdump based solution.
Littlesnitch/tcpdump/wireshark/glasswire(I think?)/opensnitch are system level tools that attempt to monitor the individual connections - which processes made them, where they were too, and tcpdump/wireshark will also show you the content of the connection.
If malware uses ip addresses or it's own dns server then Pihole will never see it.
Snort and Suricata are more likely what you're looking for as an IDS for something network wide, they analyze network wide the individual connections and can do pattern matching with known malware lists. They can't tell you what process made the request.
A pihole certainly wouldn't hurt and is very easy to use, it's not really made to be an IDS AFAIK.
Pihole operates at domain/subdomain level. So it won't resolve domains that are in your blacklist.
*Snitch operates at packet level, so whilst you can block a domain, you can also block an app's access to a particular domain but allow another app access, maybe only by one user and to a specific port.
Snitch takes much more setup and will annoy you until you've worked through all the usual traffic. It reminds me of the Proxomitron back in the day (https://en.wikipedia.org/wiki/Proxomitron).