1. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the non-transitory machine readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to: identify an execution entity attempting to access a secured system resource of an electronic device; identify a memory location including an instruction address within a subsection of the execution entity that caused the attempt; determine a byte string corresponding to a range including the memory location that caused the attempt, the range to include a defined number of bytes surrounding the memory location; and compare the byte string against mappings of the subsection in security rules to determine whether to allow the attempt based on the security rules.