1. A method comprising: identifying, by a processing device executing a hypervisor, a set of pages associated with a guest operating system (OS) of a virtual machine that are shared with an application; mapping, by the hypervisor each of the set of pages associated with the guest OS to a corresponding page associated with the application, the mapping stored in a mapping table accessible by the hypervisor; modifying, by the hypervisor, a write protection attribute for each corresponding page associated with the application to cause a protection page fault upon an application attempt to update the corresponding page; detecting, by the hypervisor, updated pages, wherein detecting updated pages comprises detecting the protection page fault upon the application attempt to update one of the corresponding pages associated with the application; and logging, by the hypervisor, a modification of each updated corresponding page.