[winrid]

I've been building watch.ly[0] which intercepts all network /fs traffic on the machine originating from the agent and pings you for approval.

[0] https://watch.ly