Usually both. They check known malware signatures and also look for suspicious behavior.