First, a Merry Christmas to all.

Are there examples of 'running items' if you look at Activity Monitor that one should be on the lookout for that might raise suspicions? Just curious and want to learn more about this.