1. A system for detecting malicious processes, the system comprising a processor running a plurality of processes, the processor configured to, for each process: collect a plurality of features of the process; apply a plurality of classification rules to the plurality of features to produce a plurality of weighted threat scores, wherein each of the plurality of classification rules corresponds to a one or more of a plurality of process categories; compare the plurality of weighted threat scores to a plurality of threshold values, wherein each of the plurality of threshold values corresponds to one of the plurality of process categories; and classify the process in the one or more process categories based at least on the comparison of the plurality of weighted threat scores to the plurality of predetermined thresholds.