in theory it should work against osquery as a method to escalate privs from user to root (looking at the

quicklook_cache

table)