1. A computer-implemented method for tracking malware execution on a client computer, the method comprising: detecting at the client computer a potential malware application; collecting threat information about the potential malware application, wherein the threat information includes information identifying at least one resource of the client computer accessed by the potential malware application; submitting the threat information to a back-end service for further analysis; receiving a threat signature and mitigation information from the back-end service, wherein the signature includes data for detecting a threat confirmed by the back-end service; and applying one or more mitigation actions to the detected potential malware application based on the signature received from the back-end service.