If you can execute code on the host I don't think this attack is necessary, unless maybe you disable execution entirely for unsigned programs. The attacker can

If you can execute code on the host I don't think this attack is necessary, unless maybe you disable execution entirely for unsigned programs. The attacker can drop/ exec files as they please, regardless of whether they're signed. Anyone can feel free to correct me.