Behavioral Antivirus

Watches processes while they run — file writes, network calls, memory access — and stops them mid-action if the behaviour matches an attack. Forensic Toolkit examines the aftermath; this catches the act.