1. A method for detecting attempts to change memory by a group of instructions comprising: during a trial period: temporarily marking as read-only a memory page that includes a memory location to be observed; catching an exception when an instruction attempts to write to the marked memory page; in response to the instruction attempting to write to the memory location to be observed, storing an identifier of the instruction in a watch list, wherein the identifier uniquely identifies the instruction based on a memory address from which the instruction is fetched; subsequent to the trial period: marking the memory page writable; and detecting attempts, based on the watch list, to execute the identified instruction.