I could imagine either just a vanilla app blacklist that's regularly updated, or maybe a scanner that looks for known third party libraries commonly used for evil purposes?