1. A method of detecting a malicious file at a client, comprising: detecting thread creation events performed by an operating system of the client; collecting data about detected thread creation events, the collected data for a thread creation event including an identity of a created thread, an identity of a process that created the thread, and an identity of a file stored by the client that was executed to form the process that created the thread; analyzing an address space of a process executing on the client to identify legitimate memory regions in the address space known to not contain malware; identifying a thread of the process executing on the client referencing a location in the address space of the process outside of the legitimate memory regions, the location designated as a suspicious memory region; designating the thread referencing the suspicious memory region as a suspicious thread; identifying a malicious file associated with the suspicious thread by accessing the collected data about detected thread creation events to identify a file stored by the client that was executed to form a process that created the suspicious thread, identifying the malicious file comprising: determining an identifier of the suspicious thread by querying the operating system for the identifier of the suspicious thread and receiving the identifier of the suspicious thread from the operating system in response to the query; providing the identifier of the suspicious thread to a service that receives a thread identifier identifying a thread and responds with an identity of a file that created the identified thread, the service using the collected data about detected thread creation events; and receiving from the service, in response to providing the identifier of the suspicious thread, an identifier of the malicious file associated with the suspicious thread; and remediating the malicious file associated with the suspicious thread.