I am not sure if it is ok, but i have created a bug with the writeup: https://github.com/osquery/osquery/issues/7045 . Also i have some other colleagues testing it on my company and they seemed to find the same behavior.