Funnily enough, there was an article about malware doing exactly this for AV evasion some time last year. Existing behavioral analysis wouldn't be effective since they were looking at Linux syscalls.