Hey guys! I wrote a quick blog article on the

mdfind

table that @obelisk added to osquery in v3.2.6, if you haven't tried using it yet, I would recommend reading the article and giving it a spin. Because Spotlight caches the text contents of files you can find items that contain arbitrary strings in their contents! https://blog.kolide.com/spotlight-search-across-every-mac-in-your-fleet-with-osquery-55789c765986