1. A computerized method of monitoring activity at a monitored computerized device, the monitored device running one or more processes, at least one of the processes executing one or more system events being part of an activity, the method comprising, using a computer processor for: obtaining an execution plan, the executing plan is generated based on agent configuration data; the agent configuration data is indicative of at least one process of interest and at least one activity signature; the activity signature representing a respective activity of interest and comprises a group of one or more opcodes enabling to uniquely identify the respective activity of interest; each opcode represents a respective system event of interest and comprises information indicative of one or more conditions, enabling to identify the respective system event of interest; the execution plan comprising, for at least one respective system event of interest, one or more assistive technology API queries; each query is generated based on a condition of a respective opcode and enables to obtain descriptive information of the at least one respective system event of interest; responsive to detection of a given system event, using the execution plan for calling the one or more assistive technology API queries of the given system event and obtaining descriptive information of the given system event; determining that the given system event is a system event of interest, if the descriptive information of the given system event meets the respective conditions of the respective opcode; and determining that a given activity of interest has been executed if system events of interest represented by a group of respective opcodes in a signature representing the activity of interest, are identified.