Malicious files detection and disarming

A method comprising:

• detecting a start of one of a set of monitored process, each associated with an application installed on a computer system,
• injecting said detected monitored process of said set of monitored process with a software module configured to intercept specified functions calls by the monitored process, wherein said specified function call are associated with file operations attempted by the monitored process,
• intercepting, by said software module, a function call of one of said specified function calls,
• modifying, by said software module, an execution of said function, to suspend said file operation attempted by said monitored process,
• processing a file referenced by said file operation, by applying a plurality of data security operations thereupon,
• returning an expected value to said monitored process with respect to said file, and
• issuing a notification to a user of said computer system with respect to a result of said processing.

A computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by at least one hardware processor to:

• detect a start of one of a set of monitored process, each associated with an application installed on a computer system,
• inject said detected monitored process of said set of monitored process with a software module configured to intercept specified functions calls by the monitored process, wherein said specified function call are associated with file operations attempted by the monitored process,
• intercept, by said software module, a function call of one of said specified function calls,
• modify, by said software module, an execution of said function, to suspend said file operation attempted by said monitored process,
• process a file referenced by said file operation, by applying a plurality of data security operations thereupon,
• return an expected value to said monitored process with respect to said file, and
• issue a notification to a user of said computer system with respect to a result of said processing.