1. A computer program product for detecting malicious computer code in a host computer, the computer program product comprising a non-transitory computer-readable storage medium containing executable computer program code for performing a method comprising: identifying a plurality of threads executed on the host computer; tracking the identified threads in a runtime database; analyzing data addressed to exit the host computer via a port of the host computer, wherein executable content does not normally exit the host computer via the port; determining whether the data addressed to exit the host computer via the port contain outbound executable content; when outbound executable content is addressed to exit the identified port, determining whether the outbound executable content matches an identified thread in the runtime database; and declaring a suspicion of malicious computer code in the outbound executable content if the outbound executable content matches an identified thread in the runtime database.