A heuristic-based AV scans a file by following rulesets and detecting patterns, i.e., walking through an executable instruction-by-instruction to learn its behavior.