quick q: does the

setuid_bin

table also show setgid binaries?

https://github.com/facebook/osquery/blob/master/osquery/tables/system/posix/suid_bin.cpp Based on my novice reading of the code, seems like it's looking at setgid binaries.

r["permissions"] = "";
  if ((perms & 04000) == 04000) {
    r["permissions"] += "S";
  }

  if ((perms & 02000) == 02000) {
    r["permissions"] += "G";
  }

I don't know C++ but that's what it also looks like to me. awesome, thanks for digging up the code!