Techniques relate to fingerprint-based processor malfunction detection. A determination is made whether a fingerprint is present in software that is currently executing on the processor of the computer system. The fingerprint includes a representation of a sequence of behavior that occurs on the processor while the software is executing. The fingerprint corresponds to a type of malfunction. In response to determining that the fingerprint is not present in the software currently executing on the processor, monitoring of the software executing on the processor to determine whether the fingerprint is present continues. In response to determining that the fingerprint is present in the software executing on the processor, it is determined that the malfunction has occurred according to a type of the fingerprint that is present.