I would imagine these tools use exploits in the existing executables to deliver the payload, and then - if I understand correctly, use scripting/interpreted lan

I would imagine these tools use exploits in the existing executables to deliver the payload, and then - if I understand correctly, use scripting/interpreted languages (Python) to run the operation. So, even if you’d need admin confirmation to run each new binary, it wouldn’t help - because no new binaries are executed, just python with a new set of scripts. And, correct me if I’m wrong, but preventing os from running new scripts would be virtually impossible.