It could look at the user agent that's being reported, but that's something that's easy to change. Application in this context doesn't really refer to a specific application that the client is using, but rather the protocol that is in use. It's referring to the application layer of the OSI/TCP models. For example, a packet filtering firewall could be configured to do something like only allow outbound traffic with a destination port of port 80 (standard HTTP).

However, I could do something like run SSH on that port and create a semi-covert channel. The firewall wouldn't have any problems with that since I'm adhering to the rules. However, an application-level firewall would actually perform deeper packet inspection and notice that I'm not making HTTP connections. If it was configured to only allow HTTP, my connection would be denied and logs/alerts would be generated.

It sounds like you might be trying to detect illicit software installs on your client machines.  There are much more reliable ways to do that than using a firewall.  Look at client side solutions to protect the endpoint.  These are much more reliable for detecting the sorts of changes you mention.