if you're doing it without events, you could also get a hash of the binary, and that in case of sudo that should stand out.