Behavior-based detection

Security tools that look for suspicious actions, such as mass file encryption, credential dumping, unusual PowerShell activity, or a process spawning unexpectedly from a web service account.