NetWatch performs background detection of C2 beacon communications, port scans, and DNS tunneling, and freezes the flight recorder to preserve relevant packets when a critical alert is triggered.