there's a file carver feature in osquery, but none of the popular opensource TLS servers support it yet. the file carver feature allows you to copy a file from the remote host to your server.