A host system comprising at least one hardware processor and a memory unit, the at least one hardware processor configured to execute an entity manager and a heuristic engine, wherein: the entity manager is configured to organize a collection of monitored executable entities into a plurality of entity groups, wherein organizing the collection comprises: in response to detecting that a first entity of the collection has spawned a child entity, determining whether the first entity belongs to a group creator category of entities; in response to determining whether the first entity belongs to the group creator category, when the first entity belongs to the group creator category: adding a new entity group to the plurality of entity groups, and assigning the child entity to the new entity group; and in response to determining whether the first entity belongs to the group creator category, when the first entity does not belong to the group creator category: selecting a first entity group from the plurality of entity groups so that the first entity is a member of the first entity group, and assigning the child entity to the first entity group; and the heuristic engine is configured, in response to a first action performed by the child entity, to: select a second entity group from the plurality of entity groups so that the child entity is a member of the second entity group, wherein the child entity is a member of the second entity group while also being a member of the first entity group or of the new entity group; and in response to selecting the second entity group, determine whether the first action is indicative of a malware attack according to a second action performed by another member of the second entity group. the entity manager is configured to organize a collection of monitored executable entities into a plurality of entity groups, wherein organizing the collection comprises: in response to detecting that a first entity of the collection has spawned a child entity, determining whether the first entity belongs to a group creator category of entities; in response to determining whether the first entity belongs to the group creator category, when the first entity belongs to the group creator category: adding a new entity group to the plurality of entity groups, and assigning the child entity to the new entity group; and in response to determining whether the first entity belongs to the group creator category, when the first entity does not belong to the group creator category: selecting a first entity group from the plurality of entity groups so that the first entity is a member of the first entity group, and assigning the child entity to the first entity group; and in response to detecting that a first entity of the collection has spawned a child entity, determining whether the first entity belongs to a group creator category of entities; in response to determining whether the first entity belongs to the group creator category, when the first entity belongs to the group creator category: adding a new entity group to the plurality of entity groups, and assigning the child entity to the new entity group; and adding a new entity group to the plurality of entity groups, and assigning the child entity to the new entity group; and in response to determining whether the first entity belongs to the group creator category, when the first entity does not belong to the group creator category: selecting a first entity group from the plurality of entity groups so that the first entity is a member of the first entity group, and assigning the child entity to the first entity group; and selecting a first entity group from the plurality of entity groups so that the first entity is a member of the first entity group, and assigning the child entity to the first entity group; and the heuristic engine is configured, in response to a first action performed by the child entity, to: select a second entity group from the plurality of entity groups so that the child entity is a member of the second entity group, wherein the child entity is a member of the second entity group while also being a member of the first entity group or of the new entity group; and in response to selecting the second entity group, determine whether the first action is indicative of a malware attack according to a second action performed by another member of the second entity group. select a second entity group from the plurality of entity groups so that the child entity is a member of the second entity group, wherein the child entity is a member of the second entity group while also being a member of the first entity group or of the new entity group; and in response to selecting the second entity group, determine whether the first action is indicative of a malware attack according to a second action performed by another member of the second entity group.