have you looked at osquery specifically for monitoring priviledged user activities yet?