Add OBSERVE_EXEC_NOACCESS and filter exec calls that will fail by default