1. At least one non-transitory computer readable storage medium that includes code for execution, that when executed, causes at least one processor to: identify an execution of a hook of an application programming interface (API), wherein the execution of the hook is caused, at least in part, by an application; responsive to the execution of the hook, determine whether a runtime module is enabled, wherein the runtime module determines whether a thread of the application made an API call; responsive to determining that the runtime module is enabled, determine whether the application has a system token; and terminate at least the thread of the application based on determining that the runtime module is enabled and the application has the system token.