A method comprising: (a) enumerating (324, 326), based on a query of an operating executive of a computer system and sent in response to a trigger, a plurality of memory regions of an address space in memory of the computer system to define memory region address information, the memory region address information including a start address and an end address of each memory region from the plurality of memory regions in the address space, the trigger being the start of a socket operation; and (b) scanning memory of the computer system for a memory injection, wherein the scanning step comprises: (i) determining whether a first memory region from the plurality of memory regions corresponds to any loaded module from a plurality of loaded modules registered with the operating executive, wherein the determining step comprises: examining the plurality of loaded modules for loaded module address information including a start address and an end address of each loaded module from the plurality of loaded modules in the address space; and comparing the memory region address information to the loaded module address information including comparing the start address and the end address of each loaded module from the plurality of loaded modules to the start address and the end address of the first memory region; and (ii) wherein, when the first memory region does not correspond to any loaded module from the plurality of loaded modules, determining whether the first memory region contains an executable, and, when the first memory region contains an executable, generating a memory injection alarm. (a) enumerating (324, 326), based on a query of an operating executive of a computer system and sent in response to a trigger, a plurality of memory regions of an address space in memory of the computer system to define memory region address information, the memory region address information including a start address and an end address of each memory region from the plurality of memory regions in the address space, the trigger being the start of a socket operation; and (b) scanning memory of the computer system for a memory injection, wherein the scanning step comprises: (i) determining whether a first memory region from the plurality of memory regions corresponds to any loaded module from a plurality of loaded modules registered with the operating executive, wherein the determining step comprises: examining the plurality of loaded modules for loaded module address information including a start address and an end address of each loaded module from the plurality of loaded modules in the address space; and comparing the memory region address information to the loaded module address information including comparing the start address and the end address of each loaded module from the plurality of loaded modules to the start address and the end address of the first memory region; and (ii) wherein, when the first memory region does not correspond to any loaded module from the plurality of loaded modules, determining whether the first memory region contains an executable, and, when the first memory region contains an executable, generating a memory injection alarm. (i) determining whether a first memory region from the plurality of memory regions corresponds to any loaded module from a plurality of loaded modules registered with the operating executive, wherein the determining step comprises: examining the plurality of loaded modules for loaded module address information including a start address and an end address of each loaded module from the plurality of loaded modules in the address space; and comparing the memory region address information to the loaded module address information including comparing the start address and the end address of each loaded module from the plurality of loaded modules to the start address and the end address of the first memory region; and examining the plurality of loaded modules for loaded module address information including a start address and an end address of each loaded module from the plurality of loaded modules in the address space; and comparing the memory region address information to the loaded module address information including comparing the start address and the end address of each loaded module from the plurality of loaded modules to the start address and the end address of the first memory region; and (ii) wherein, when the first memory region does not correspond to any loaded module from the plurality of loaded modules, determining whether the first memory region contains an executable, and, when the first memory region contains an executable, generating a memory injection alarm.