Behavior Monitoring uses the Memory Scan Trigger Pattern to identify possible threats after detecting the following operations:
File write action
Registry write action
New process creation
After identifying one of these operations, Behavior Monitoring calls Real-time Scan's Memory Inspection Pattern to check for security risks.
For details about the Real-time Scan operations, see Memory Inspection Pattern.