A cloud provider's security team wants to detect malware and rootkits running inside customer VMs on their Type 1 hypervisor platform without installing any agent inside the guest operating systems, which tenants control. They need a mechanism that observes guest memory and process state from a trusted vantage point outside the VM. Which technology best meets this requirement?