So in order to get commands to an osquery agent you would have to be able to MITM TLS with a valid cert or own the management software.