1. A computer-implemented method for categorizing processes as malicious, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: storing, in a security application that tracks event data for the computing device, data about an event triggered by an uncategorized process on the computing device; storing, in the security application, new data about an additional event triggered by an additional process on the computing device that has not previously been determined by the security application to be connected to the uncategorized process; comparing the new data about the additional event with the data about the event to determine whether the additional data shares a common variable with the data; identifying, based on determining that the additional data shares the common variable with the data, a malicious chain of events that comprises the event and the additional event; categorizing the uncategorized process as malicious in response to identifying the malicious chain of events.