1. A method for detecting malicious activity comprising: receiving information indicating a first process being executed, the first process including a plurality of first process components; receiving information specific to at least one of the plurality of first process components; determining whether the first process exhibits malicious behavior; and identifying which of the plurality of first process components is responsible for the malicious behavior based on the received information.