There are Yara rules submitted by SANS ISC to detect BeEF, and these could be repurposed by yarashop for the network layer as a early-warning detection system. The author shows how to utilize Volatility to read into a memory capture and look for BeEF-related signatures and communications -- https://isc.sans.edu/diary/When+Hunting+BeEF%2C+Yara+rules+%28Part+2%29/20505
Emerging Threats, recently acquired by Proofpoint, has a set of Snort rules -- https://rules.emergingthreats.net/open/snort-2.9.0/rules/ -- many of which cover BeEF, XSS, Scanbox, et al. You will especially want to check out the emerging-trojan.rules and emerging-web_client.rules files. There are specific entries for BeEF and Scanbox, as well as generic ones to catch active XSS from the client (i.e., browser) perspective.