Pregunta de entrevista de Salesforce

How would you approach identifying malicious user behavior?