1. A computer-implemented method, comprising: determining an event generated at a processing system of a host computing device in a multi-tenant environment, the event being generated in response to execution of a workload on an instance running on the host computing device, the instance associated with a customer having an account with a provider of the multi-tenant environment; receiving, at a first interval, a current value of a first hardware counter at a privileged instance running on the host computing device, the first hardware counter being at the processing system of the host computing device, a type of the first hardware counter being associated with the event and the value corresponding to a number of occurrences of the event on the host computing device; sending, from the privileged instance running on the host computing device, the current value of the first hardware counter to a central computing device in the multi-tenant environment; obtaining, from a database at the central computing device, one or more hardware counter patterns derived at least from reference values of the type of counter, the hardware counter patterns determined to be indicative of anomalous behavior; comparing the current value of the first hardware counter to the one or more hardware counter patterns; and determining, in response to the current value of the hardware counter corresponding to at least one of the one or more hardware counter patterns, that anomalous behavior is associated with the execution of the workload, wherein the determination of anomalous behavior is performed without accessing data stored on the instance associated with the customer.