A host system comprising a hardware processor and a memory, the hardware processor configured to execute a virtual machine (VM), an event filter, and an introspection engine, the event filter executing within the VM, the introspection engine executing outside of the VM, the hardware processor further configured to: generate an exception in response to detecting an attempt by a software entity executing within the VM to access a memory location in a manner which violates a memory access permission; and in response to the exception, switch from executing the software entity to executing the event filter; wherein the event filter is configured to: in response to the exception, determine whether the memory location currently stores a part of a page table entry used by the hardware processor to perform memory address translations for the VM, the part comprising a control bit or a memory address, in response, when the memory location currently stores the part of the page table entry, trigger a VM exit event to cause the hardware processor to suspend execution of the VM and to switch to executing the introspection engine, and when the memory location does not store the part of the page table entry, cause the hardware processor to resume executing the software entity without triggering the VM exit event; and wherein the introspection engine is configured to determine whether the attempt is malicious in response to the VM exit event. generate an exception in response to detecting an attempt by a software entity executing within the VM to access a memory location in a manner which violates a memory access permission; and in response to the exception, switch from executing the software entity to executing the event filter; wherein the event filter is configured to: in response to the exception, determine whether the memory location currently stores a part of a page table entry used by the hardware processor to perform memory address translations for the VM, the part comprising a control bit or a memory address, in response, when the memory location currently stores the part of the page table entry, trigger a VM exit event to cause the hardware processor to suspend execution of the VM and to switch to executing the introspection engine, and when the memory location does not store the part of the page table entry, cause the hardware processor to resume executing the software entity without triggering the VM exit event; in response to the exception, determine whether the memory location currently stores a part of a page table entry used by the hardware processor to perform memory address translations for the VM, the part comprising a control bit or a memory address, in response, when the memory location currently stores the part of the page table entry, trigger a VM exit event to cause the hardware processor to suspend execution of the VM and to switch to executing the introspection engine, and when the memory location does not store the part of the page table entry, cause the hardware processor to resume executing the software entity without triggering the VM exit event; and wherein the introspection engine is configured to determine whether the attempt is malicious in response to the VM exit event. <EOS>