@clong

{"atime":"1520039739","auid":"4294967295","btime":"0","cmdline":"sudo id","ctime":"1506457131","cwd"
:"\/var\/log\/osquery","egid":"0","euid":"0","gid":"1000","mode":"0104755","mtime":"1499153837","owner_gid":"0","owner_uid":"0","par
ent":"8041","path":"\/usr\/bin\/sudo","pid":"20066","status":"","time":"1520039832","uid":"1000","uptime":"<justno>"}

you should get an executable path with syscalls. am i understanding it wrong?