1. A system for securing an electronic device, comprising: a processor; a non-transitory machine readable medium communicatively coupled to a hardware processor; and an anti-malware module including instructions on the non-transitory machine readable medium, the instructions, when loaded and executed by the processor, cause the processor to: identify a plurality of memory regions of the electronic device to be monitored, each memory region representing a respective CPU address space; identify one or more operations representing transitions between the memory regions to be monitored, including an identification of an instruction fetch to be monitored; identify a pattern of the operations to be monitored according to the identification of the instruction fetch, the pattern including a series of a plurality of defined operations representing transitions between a first memory region representing a kernel space and a second memory region representing a user space; determine that the identified pattern of the operations has occurred; generate and record a notification that the identified pattern of the operations has occurred; based on the notification and the pattern of the operations, determine whether the identified pattern of the operations is indicative of malware; and take corrective action in response to determining that the identified pattern of the operations has occurred and is indicative of malware.