@kizyle502 yeah i don’t think osquery (or any tool i can think of off the top of my head) can do that. It would be hard since the program would have to save the contents of the file before it changed so it could compare it to the contents afterwards. Seems like a lot of overhead.