Any thoughts on setting up FIM+some queries or process auditing to detect: http://www.openwall.com/lists/oss-security/2017/05/30/16 it would make an awesome blog post if you could!