Detecting members of Mal/Behav-222 is based on behavior based.


More information can be found at this Sophos page.