Not sure the best place to post but I put out blog post related to osquery yara scanning if anyone is interested: https://developer.squareup.com/blog/leveraging-linux-internals-to-supercharge-osquery-malware-detection/