Behavioural detection

Behavioural detection looks for what an attacker does rather than which file they used.

Files, addresses and domains change in minutes. Techniques change slowly, because they reflect what actually works. A rule keyed to a specific file stops working immediately; one keyed to the behaviour of dumping credentials from memory keeps working across tools and years. It is more work to build and dramatically longer-lived.