1. At least one machine accessible storage medium having instructions stored thereon for detecting malicious code in a script, wherein the instructions, when executed by at least one processor, cause the at least one processor to: initiate an execution of a compiled script; evaluate a function called in the compiled script; detect an execution event based on at least a first criterion; store information associated with the execution event in an execution event queue; and verify a correlation signature based on information associated with at least one execution event in the execution event queue.