Real time protection offers behavior monitoring- see Configure always-on real-time Windows Defender Antivirus protection, Turn on behavior monitoring . Does someone know what WD monitors?