1. An apparatus, comprising: a memory; and a processor operatively coupled to the memory, the processor configured to receive a set of indications of allowed behavior specific to a first application, the processor configured to initiate an instance of the first application within a sandbox environment, the instance of the first application configured to initiate an instance of a second application within the sandbox environment, the processor configured to receive, from a monitor associated with the sandbox environment, an indication that the instance of the second application is attempting to modify a registry key, the processor configured to classify the attempt to modify the registry key as an anomalous behavior for the second application based on an indication of modifying the registry key not being in the set of indications of allowed behavior specific to the first application, the processor configured to define and store a signature for the second application using a cryptographic hash value of a file associated with the second application in response to classifying the attempt to modify the registry key as an anomalous behavior for the second application, and the processor configured to terminate the second application in response to classifying the attempt to modify the registry key as an anomalous behavior for the second application.