System and method for triggering analysis of an object for malware in response to modification of that object

A system comprising:

• one or more processors;
• and
• a memory communicatively coupled to the one or more processors, the memory including
• a file system including an Application Programming Interface (API) operating as an interface to the file system, and
• monitoring logic remotely located from the file system, the monitoring logic, when executed by the one or more processors, monitors the API to detect a notification message that is directed to a destination other than the monitoring logic and identifies a state change event representing an activity causing a change in state of a data store associated with the file system to occur, the notification message, at least in part, triggering a malware analysis to be conducted on an object associated with the state change event.

A computerized method for monitoring a file system, including an Application Programming Interface (API) operating as an interface, by monitoring logic remotely located from the file system, comprising:

• monitoring the API to detect a notification message that is directed to a destination other than the monitoring logic;
• and
• identifying a state change event representing an activity causing a change in state of a data store associated with the file system to occur,
• wherein the notification message, at least in part, triggering a malware analysis to be conducted on an object associated with the state change event.