1. A system comprising: a central processing unit (CPU) of an exploit detection system; a memory coupled to the CPU and configured to store: a threat-aware microvisor executable by the CPU to generate a capability violation in response to a process executing in an operating system attempting to access a kernel resource for which the process does not have permission, the threat-aware microvisor having a main protection domain including one or more execution contexts and capabilities defining permissions for the process to access the kernel resource; a virtual machine monitor (VMM) executable by the CPU to, in response to the capability violation, spawn a micro-virtual machine as a container configured to encapsulate the process, the micro-virtual machine further configured to monitor operation of the process as the process attempts to access the kernel resource to detect whether the process includes an exploit; and a cloned protection domain representative of the process, the cloned protection domain created by copying the execution contexts and capabilities of the main protection domain, wherein the capabilities of the cloned protection domain are more restricted than the capabilities of the main protection domain with respect to access to the kernel resource, and wherein the restricted capabilities of the cloned protection domain are configured to generate more capability violations than the capability violation generated by the capabilities of the main protection domain.