it could be any trick of osquery core