A method for monitoring, comprising: automatically tracking activities performed by at least a group of computers (22, 24) in a computer system; determining for each of the tracked activities, a target computer of the activity; and upon detecting that a given computer in the system has performed anomalous activities, initiating an action to inhibit malicious exploitation of the given computer, characterized in: identifying in the tracked activities, activities included in a defined list of a plurality of different types of administrative activities involving access to other computers; assigning respective weights to the administrative activities responsively to respective frequencies of performance of the administrative activities in the computer system, such that the respective weights decrease as the respective frequencies increase; establishing, for each of a plurality of computers in the computer system, a respective baseline including the targets accessed by the computer using one or more of the types of administrative activities in the defined list, and the specific types of administrative activities used in accessing each of the targets by the computer;determining based on the collected data, administrative activities performed by the group of the computers in the system, over a predetermined period, and the corresponding targets of the administrative activities; determining pairs of the administrative activities and corresponding targets performed over the predetermined period by each of the computers in the group, not included in the respective established baseline of the computer; and computing, by the processor, a score for each of the computers, as a sum of the weights of the determined pairs of the administrative activities and corresponding targets performed by the computer during the predetermined period, that are not in the respective baseline, and deciding that the combination of the administrative activities performed by the computer is anomalous if the score exceeds a predefined threshold. automatically tracking activities performed by at least a group of computers (22, 24) in a computer system; determining for each of the tracked activities, a target computer of the activity; and upon detecting that a given computer in the system has performed anomalous activities, initiating an action to inhibit malicious exploitation of the given computer, characterized in: identifying in the tracked activities, activities included in a defined list of a plurality of different types of administrative activities involving access to other computers; assigning respective weights to the administrative activities responsively to respective frequencies of performance of the administrative activities in the computer system, such that the respective weights decrease as the respective frequencies increase; establishing, for each of a plurality of computers in the computer system, a respective baseline including the targets accessed by the computer using one or more of the types of administrative activities in the defined list, and the specific types of administrative activities used in accessing each of the targets by the computer;determining based on the collected data, administrative activities performed by the group of the computers in the system, over a predetermined period, and the corresponding targets of the administrative activities; determining pairs of the administrative activities and corresponding targets performed over the predetermined period by each of the computers in the group, not included in the respective established baseline of the computer; and computing, by the processor, a score for each of the computers, as a sum of the weights of the determined pairs of the administrative activities and corresponding targets performed by the computer during the predetermined period, that are not in the respective baseline, and deciding that the combination of the administrative activities performed by the computer is anomalous if the score exceeds a predefined threshold. identifying in the tracked activities, activities included in a defined list of a plurality of different types of administrative activities involving access to other computers; assigning respective weights to the administrative activities responsively to respective frequencies of performance of the administrative activities in the computer system, such that the respective weights decrease as the respective frequencies increase; establishing, for each of a plurality of computers in the computer system, a respective baseline including the targets accessed by the computer using one or more of the types of administrative activities in the defined list, and the specific types of administrative activities used in accessing each of the targets by the computer;determining based on the collected data, administrative activities performed by the group of the computers in the system, over a predetermined period, and the corresponding targets of the administrative activities; determining pairs of the administrative activities and corresponding targets performed over the predetermined period by each of the computers in the group, not included in the respective established baseline of the computer; and computing, by the processor, a score for each of the computers, as a sum of the weights of the determined pairs of the administrative activities and corresponding targets performed by the computer during the predetermined period, that are not in the respective baseline, and deciding that the combination of the administrative activities performed by the computer is anomalous if the score exceeds a predefined threshold.