A monitoring system is configured to monitor a property. The monitoring system includes a camera, a sensor, and a monitor control unit. The monitor control unit is configured to receive image data and sensor data. The monitor control unit is configured to determine that the image data includes a representation of a person. The monitor control unit is configured to determine an orientation of a representation of a head of the person. The monitor control unit is configured to determine that the representation of the head of the person likely includes a representation of a face of the person. The monitor control unit is configured to determine that the face of the person is likely concealed. The monitor control unit is configured to determine a malicious intent score that reflects a likelihood that the person has a malicious intent. The monitor control unit is configured to perform an action.