Has anyone else seen OSQuery do something similar?