According to an aspect of some embodiments of the present invention there is provided a computer-implemented method for detection of malicious code within runtime generated code executing within a computer, comprising executing on a processor of the computer the acts of: receiving an indication of at least one of the creation and the execution of runtime generated code in a memory of a computer; identifying a match between signature data associated with the runtime generated code and a template signature of a plurality of templates representing authorized source creation modules that created the runtime generated code, the templates stored in a repository on a storage device; and triggering a security process to handle malicious code in the runtime generated code when no match is found.