I wonder if osquery could parse auditd events to try to track this sort of thing better?