Given the recent pkexec LPE; is there a way for osquery to find such privilege elevations? (does bpf_process_events contain enough information?)