Some attacks look normal until they aren’t. We watch for the patterns that give them away