I've tried different variations of quoting with single and double quotes. I will keep trying though. Sure, this is probably related to that. Was just looking for some help from anyone on debugging or troubleshooting who dealt with this before. Appreciate any insight. If you look at this Stack Overflow, someone had the same issue and it was an issue with osquery agent reading UTF-16 strings on the flag file 🙂