It's just basic EDR .. you have events that are flagged .. so on linux, let's say someone does something like setuid or setgid on a system file. Innocuous but potentially dangerous actions like this get flagged in the system.

These events are correlated against other actions that might have happened on the same system or other systems that the user had logged onto prior to this one.

Even if it's not the same user, the events are still correlated and alerted upon if suspicous. (both individually and holistically)

If users are using microsoft authentication for access, the accounts will be flagged and locked out, generally forcing users to fully authenticate with MFA and forcing a password change.