@chrishumphries I agree with @clong. The osx-attacks pack and other signature style packs while useful, is not a model that scales well. Eventually you will end up with tens of thousands of queries all looking for very ridged artifacts that are easily changed by the malware author. Where osquery shines is collecting large swaths of data (for example all the persistence mechanisms across the platforms) and performing analytics on top of that data to find common traits exhibited by malware.