@Kenny Stevens the audit subsystem can detect that, not sure how you'd get it out of osquery tho