Late response, in theory it works. This is exactly what some orgs think is worth outsourcing to vendor products, though. Doesn't stop you from being proactive. In practice, looking at too granular an artifact is usually a bad idea (as it's a 'tell' to anything actively trying to evade detection) but (while labor intensive) a model of this and things like Santa is to define 'normal' and look at all non-normal behavior to at least log it.