Common ones I have seen used:
Loitering >~45-60 seconds in particular areas, often after hours. The definition of "particular area" changes property to property, but is generally some place away from common traffic paths and near benches, rocks, playground equipment, or other sittable areas.
Group > 3-5. Again, the specific number may vary. The idea is to look for a larger than average grouping of people. The number may also change between day time and night time, or based on the area being monitored.
Line cross/entry from uncommon area or path. Generally this would be to detect people entering through alleyways, back paths, etc.
In all cases the analytics serve to bring events to an operators attention, not to act as an absolute indicator of Bad Things Happening. You may find that as many as 50% of the alerts are valid detections of what you wanted, but not indicative of anything bad (eg: 2 residents loitering in back area at 11PM waiting for an Uber pickup). The operator needs to have some familiarity with the site and what is "normal".
A common response if they suspect the people in the video are a bit shady, but technically not doing anything wrong is to do a live audio talk down along the lines of "This is security officer XXXX performing a live video checkin of site YYY for your safety. We are monitoring the site for your safety." Residents and regular people will tend to appreciate the announcement and be OK with it. Shady persons will likely move to some other location where their presence does not initiate voices from the sky.