It's not an antivirus, it doesn't care about binary signatures. It looks attack patterns based on known attacker behavior. A good linux example would be httpd

It's not an antivirus, it doesn't care about binary signatures. It looks attack patterns based on known attacker behavior. A good linux example would be httpd starting netcat that connects to a remote port. Or firefox spawning a bash shell. For windows a simple example would be when an office app starts wscript or powershell and that child process schedules taks, wmi, downloads a payload,etc... Those are simple examples but they track more complex attack scenarios, for cloud hosted solutions like defender atp and crowdstrike they also collect everything that happens on every device of every customer, so if they find new malware or an attacker with a certain TTP on one device, they will deploy rules to catch that for all their customers.