Glossary: Endpoint and Application Security

Behavior-based detection

Also written: behavior detection, behavior rules

Spotting attacks by what programs do, such as a document starting PowerShell or a program running from /tmp, rather than by known files. It catches new malware but also raises false alarms.