New alternative to osquery (not endorsing this, just posting for interest): https://docs.velociraptor.velocidex.com/resources/crikeycon_2019.pdf