you can write one pretty easily with the osquery-go sdk @sepuku i’ve written a few things like this internally at #C1XCLA5DZ