1. A method for detecting attempts to change memory by a group of instructions comprising: identifying a predetermined number of the group of instructions, each of which that writes to memory locations to be observed; and detecting attempts to execute one or more of the predetermined number of the group instructions.