1. A computer-implemented method comprising: detecting a first action associated with malicious code; responsive to detecting the first action, gathering data associated with the first action while refraining from taking a preventative action; upon detecting one or more subsequent actions associated with malicious code, the one or more subsequent actions occurring after the first action, performing the preventative action.