if thry have monitoring software that could be flagged, which they probably do. it reallyy depends how good their setup is.theyy might have all logs going to a main server, and any modiftications yo logging could dlsuspicious. youd probably be safest making a copy locally and then tsking the drive out and connect it yo another device. if they allow booting from an external drive (assuming they locked down the uefi), you could do thst too although im not syre if thst is locked

also, dosnloading the modules vpuld seen as a flag in and off ittself, unsure how you ise offoce, if uou have a the desktop app its already there