A host system comprising at least one hardware processor configured to execute: a hypervisor configured to expose a virtual machine, the hypervisor executing at a greater processor privilege level than software executing within the virtual machine; a process evaluator executing within the virtual machine; a memory introspection engine executing outside the virtual machine at a processor privilege level of the hypervisor; and a process-scoring module, wherein the process evaluator is configured to: determine whether an evaluated process executing within the virtual machine performs an action, and in response, when the evaluated process performs the action, transmit a first process evaluation indicator to the process-scoring module, the first process evaluation indicator determined for the evaluated process; the memory introspection engine configured to: intercept a call to an operating system function, to detect a launch of a protected process executing within the virtual machine, wherein the operating system function is configured to add the protected process to a list of processes executing within the virtual machine, and in response to detecting the launch, determine whether the evaluated process attempts to modify a memory page of the protected process, and page, transmit a second process evaluation indicator to the process-scoring module, the second process evaluation indicator determined for the evaluated process; and the process-scoring module configured to: receive the first and second process evaluation indicators, and in response, determine whether the evaluated process is malicious according to the first and second process evaluation indicators. a hypervisor configured to expose a virtual machine, the hypervisor executing at a greater processor privilege level than software executing within the virtual machine; a process evaluator executing within the virtual machine; a memory introspection engine executing outside the virtual machine at a processor privilege level of the hypervisor; and a process-scoring module, wherein the process evaluator is configured to: determine whether an evaluated process executing within the virtual machine performs an action, and in response, when the evaluated process performs the action, transmit a first process evaluation indicator to the process-scoring module, the first process evaluation indicator determined for the evaluated process; the memory introspection engine configured to: intercept a call to an operating system function, to detect a launch of a protected process executing within the virtual machine, wherein the operating system function is configured to add the protected process to a list of processes executing within the virtual machine, and in response to detecting the launch, determine whether the evaluated process attempts to modify a memory page of the protected process, and page, transmit a second process evaluation indicator to the process-scoring module, the second process evaluation indicator determined for the evaluated process; and the process-scoring module configured to: receive the first and second process evaluation indicators, and in response, determine whether the evaluated process is malicious according to the first and second process evaluation indicators. determine whether an evaluated process executing within the virtual machine performs an action, and in response, when the evaluated process performs the action, transmit a first process evaluation indicator to the process-scoring module, the first process evaluation indicator determined for the evaluated process; intercept a call to an operating system function, to detect a launch of a protected process executing within the virtual machine, wherein the operating system function is configured to add the protected process to a list of processes executing within the virtual machine, and in response to detecting the launch, determine whether the evaluated process attempts to modify a memory page of the protected process, and page, transmit a second process evaluation indicator to the process-scoring module, the second process evaluation indicator determined for the evaluated process; and the process-scoring module determine whether the evaluated process attempts to modify a memory page of the protected process, and page, transmit a second process evaluation indicator to the process-scoring module, the second process evaluation indicator determined for the evaluated process; and the process-scoring module receive the first and second process evaluation indicators, and in response, determine whether the evaluated process is malicious according to the first and second process evaluation indicators.