Abstract: Provided are a method and system for tracking access to application data and preventing data exploitation by malicious programs. In one example, the method includes shimming into a running process of the system to create at least one monitoring hook to monitor a program, building an execution path of the monitored program, and monitoring a behavior of the execution path for malicious behavior using the monitoring hook.

Abstract: Provided are a method and system for tracking access to application data and preventing data exploitation by malicious programs. In one example, the method includes shimming into a running process of the system to create at least one monitoring hook to monitor a program, building an execution path of the monitored program, and monitoring a behavior of the execution path for malicious behavior using the monitoring hook.

Abstract: Methods, systems and computer program products for changing an object associated with a directory system of a computer system and having a current classification are provided. A request to change the object is received. The request includes a specification of a new classification of the object different from the current classification of the object. A template is retrieved identifying attributes associated with the new classification and/or the current classification responsive to the received request. Attributes of the object to change are automatically identified based on a comparison of the template associated with the new classification and/or the current classification and on current attributes of the object responsive to the received request and the identified attributes are changed. The current classification and the new classification may be a position, a role and/or a location of the object and the object may be a user account and the attributes may include group memberships.