Particular embodiments described herein provide for an electronic device that can be configured to allow malware to execute in a system, record changes to the system caused by the execution of the malware, and create detection tasks for the detection of the malware in an electronic device, where the detection tasks are at least partially based on the changes to the system caused by the execution of the malware. The detection tasks can be used to identify an infected electronic device and to create mitigation tasks that mitigate the changes to the infected electronic device caused by the malware.