@thetaphi @SecurityWriter Basically the endpoint version of this: https://infosec.exchange/@mikemacleod/110619384179332516