All realtime virus engines work off of this basic model:

Hook traffic and examine data before it is loaded into memory or written to disk. I can't see how they would approach it differently.