im thinking maybe this would just be captured as a process execution via process_events, and then any other activity would just be in the context(EUID) of the su account