Once this or something like it becomes widespread, won't sophisticated attackers simply test their attacks against this? So, for example, if it checks for `rm` invocations, just implemented the functionally of `rm` in the malware, or if it checks for exfiltration of data, then shell out to curl to do that in a different process.
If you think of making it so robust that this is impossible, you're just describing a container, which we already have.
If you think of making it so robust that this is impossible, you're just describing a container, which we already have.