Since a lots of malicious code are running in memory-only, wouldn't it be possible to sign each eXecutable codes (functions etc) of each PE files and check before each new started thread the code (in-memory) is indeed signed to continue ?
With this system, if one signed process want to inject some of his code into another process (via VirtualAllocEx, WriteProcessMemory etc) it will be fine.
What are the flaws of my reasoning ? Can this mechanism be used in practice (with some change in the PE structure or in the OS) ?
ed; I intentionally omit scripting languages and the "in-memory signed code" feature that I propose is to be used of course in addition with functionalities like Windows Guard/AppLocker