What does anti-malware software look for to determine that a program or a process is a virus?

Certain extensions of files. Sometimes, the name of the file could be something like Trojanx64. sys (I think). I had a few files of malware, but they were deleted. I believe the most common extension is. sys for viruses. Additionally, antivirus software could look into the properties of the program/process.