Oh that's a cool idea. Super useful for detection and response teams, guessing they're able to get some of that by standard OS telemetry via agents/EDR.

It's checking ACLs via API but not sure about this, I'll have to dig into it a bit.

Ha, I wrote `sketchy` for that.. Agreed though. Not a bad idea, will add it to the list.