If "an attacker" adds something to

known_hosts

that was potentially malicious, this will be reflected in osquery