1. A computer-implemented method comprising: detecting a first action associated with malicious code; responsive to detecting the first action, gathering data associated with the first action while refraining from taking a preventative action; upon detecting one or more subsequent actions associated with malicious code, the one or more subsequent actions occurring after the first action, performing the preventative action, wherein the preventative action comprises at least one of: falsifying data acquired by the malicious code; or falsifying data transmitted to an adversary associated with the malicious code.