1. An exploit detection system comprising: a threat-aware microvisor configured to generate a capability violation in response to a process executing in an operating system attempting to access a kernel resource for which the process does not have permission; and a virtual machine monitor (VMM) coupled to the microvisor and, in response to the capability violation, configured to spawn a micro-virtual machine as a container configured to encapsulate the process, the micro-virtual machine further configured to monitor operation of the process as the process attempts to access the kernel resource to detect whether the process includes an exploit.