1. A method of detecting malware in a computer system, the method comprising: determining that an executable file should be identified as not being legitimate; executing the executable file in an emulated environment; monitoring the behaviour of the executable file to determine that the executable file, aware that it is being executed in the emulated environment, is taking evasive action by failing to respond in a way in which it would be expected to act when executed in a real environment; and determining that the executable file is malware.