This might have been posted before but I couldn't find it...

"The monkey launches a browser instance for each suspect URL and waits for a few minutes. The monkey is not set up to click on any dialog box to permit installation of any software; consequently, any executable files that get created outside the browser's temporary folder are detected by the [data recorder] and signal an exploit," Wang said.
http://www.eweek.com/article2/0,1759...119TX1K0000594
Microsoft Unwraps HoneyMonkey Detection Project

Eg