Dude if you had something for automagically generating query packs for IoCs that'd be money. I think that we have most of the query packs we have as examples for what to think about/look for with osquery deploys, but on that note I don't think we do any formal maintaining - we just review new query packs and test them for sanity