1. A method for monitoring, comprising: collecting, by a processor, data regarding activities of a plurality of computers in a computer system; identifying in the plurality of computers, computers whose users identify as administrators; identifying programs run by the computers identified as administrative; generating a list of administrative activities of a plurality of different types, involving access to other computers, responsive to the identified programs and ports used by the identified programs; identifying in the collected data, activities included in the generated list of administrative activities involving access to other computers; assigning respective weights to the administrative activities in the generated list responsively to respective frequencies of performance of the administrative activities in the computer system, such that the respective weights decrease as the respective frequencies increase; determining for each of the identified activities, a target computer of the activity; establishing, for each of a plurality of computers in the computer system, a respective baseline including the targets accessed by the computer using one or more of the types of administrative activities in the generated list, and the specific types of administrative activities used in accessing each of the targets by the computer; determining based on the collected data, the administrative activities performed by at least a group of the computers in the system, over a predetermined period, and the corresponding targets of the administrative activities; determining pairs of the administrative activities and corresponding targets performed over the predetermined period by each of the computers in the group, not included in the respective established baseline of the computer; computing, by the processor, a score for each of the computers, as a sum of the weights of the determined pairs of the administrative activities and corresponding targets performed by the computer during the predetermined period, that are not in the respective baseline, and deciding that the combination of the administrative activities performed by the computer is anomalous if the score exceeds a predefined threshold; and upon detecting that a given computer in the system has performed an anomalous combination of administrative activities, initiating an action to inhibit malicious exploitation of the given computer, wherein the different types of the administrative activities comprise accessing non-existent network addresses and non-existent subnets, and wherein assigning the respective weights comprises calculating a respective weight for each type of administrative activity in inverse proportion to a number of the computers performing the administrative activity.