I am trying to build a custom malware sandbox(not using readymade approaches like cuckoo or others) I have captured the activities and operations generated by the process, now in the next phase i would like to know how threats can be detected based on the captured the activities and operations generated by the process?
Let me be very clear what i am looking for-
i just have the activities running in the system specifically generated by the process now i want to find out how can i find if something is malicious and able to prepare a report on that like we get in anyrun or any other sandboxes.

Also how does EDR platforms work (how do they find the threats and map them if they are malicious)

I have tried to map the activities and operations captured by procmon to mitre attack framework so that if something malicious is found we can be able to conclude it as malicious.
If my approach is wrong and You have better idea or approach please share it would be very helpful.