Yeah not sure osquery will be able to help you too much on that level 😕 We don't have anything currently for monitoring all syscalls in an app/binary, but that would be pretty slick