How does GCP detect crypto mining within a VM?

Are they noticing this because 100% CPU usage? Or DNS queries from the instances?

This just happened to us and it would be super helpful to know how GCP can scan it before.