1. A system, comprising: a processor; and a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to: receive an application to be tested, a set of intrusive monitoring capabilities, and a set of external monitoring capabilities; execute an application in a clean environment to generate unmonitored application behavior; execute the application with intrusive monitoring based on two randomly generated seeds to generate trigger events; execute external monitoring to detect changes in application behavior in response to executing the intrusive monitoring; compute a correlation measure between the trigger events and the detected changes in the application behavior; and modify the detected evasive application in response to detecting the application is evasive based on the correlation measure.