Behavior-based vm resource capture for forensics

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations comprising:
• monitoring, using a standard level of auditing, one or more processes of a virtual machine;
• based on monitoring the one or more processes, detecting aberrant behavior indicating an imminent attack against the virtual machine;
• based on detecting aberrant behavior indicating the imminent attack:
• monitoring, using a heightened level of auditing, the one or more processes of the virtual machine, the heightened level of auditing generating log data representative of memory accesses performed by the virtual machine;
• and
• notifying a user of the virtual machine that the imminent attack is detected;
• during the attack against the virtual machine, maintaining the monitoring of the one or more processes of the virtual machine using the heightened level of auditing;
• determining that the attack against the virtual machine has concluded;
• and
• based on determining that the attack against the virtual machine has concluded:
• processing the log data to determine an action performed by the attack;
• and
• monitoring, using the standard level of auditing, the one or more processes of the virtual machine.