1. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for monitoring task behavior in a virtual machine, which when executed by one or more processors, causes: executing a plurality of tasks in a plurality of virtual machines executing in a computing environment, wherein each task executes in a separate virtual machine instantiated for the particular task; identifying an action performed by a first task of the plurality of tasks, wherein the first task is executing in a first virtual machine; analyzing the action in relation to a set of heuristics by performing: (a) identifying a suspected file, (b) determining all files modified after an introduction of the suspected file, and (c) determining whether the suspected file should be classified as malware based, at least in part, on a set of file formats associated with said all files modified after the introduction of the suspected file, and upon classifying the suspected file as malware, initiating a data collection process to collect information about events occurring in the first virtual machine.