1. A method of identifying one or more malicious threats in a computing device, comprising: monitoring a plurality of events occurring on a computing device in run time, a plurality of processes executed on said computing device in run time, and a plurality of host activities of said computing device in run time; identifying a compliance of at least some of said plurality of events, said plurality of processes, and said plurality of host activities with a plurality of rules; generating a rule compliance status dataset generated according to said compliance; identifying a match between said rule compliance status dataset and at least one of a plurality of reference profiles each indicative of a computing device operation under a malicious threat activity; and detecting a malicious threat according to said match.