Maybe but only once in a while, I wonder how much legitimate software relies on the kernel name at runtime (vs compile time)?

Also consider it may only trigger if five syscalls to uname come in sequence from the same process. I suspect without evidence this pattern is less common.