A method, system, computer program product and/or computer readable medium of instructions to detect malicious activity. The method comprises intercepting an activity in a processing system, wherein a requesting entity requests the activity to be performed in relation to a target entity; determining, using a filter module if the activity is suspicious or non-suspicious; and in response to determining that the activity is suspicious, analysing at least one of the activity, the requesting entity and the target entity using an analysis module to detect malicious activity. There is also disclosed a method, system, computer program product and/or computer readable medium of instructions to facilitate the detection of malicious activity.