1. A method for monitoring, comprising: defining a plurality of different types of administrative activities in a computer system, each administrative activity in the plurality comprising an action performed by one of the computers in the system that can be invoked only by a user having an elevated level of privileges in the system; automatically tracking the administrative activities performed by at least a group of the computers in the system; and upon detecting that a given computer in the system has performed an anomalous combination of at least two of the different types of administrative activities, initiating an action to inhibit malicious exploitation of the given computer.