Memory Scan Trigger Pattern

Behavior Monitoring uses the Memory Scan Trigger Pattern to identify possible threats after detecting the following operations:

  • File write action

  • Registry write action

  • New process creation

After identifying one of these operations, Behavior Monitoring calls Real-time Scan's Memory Inspection Pattern to check for security risks.

For details about the Real-time Scan operations, see Memory Inspection Pattern.