tried a bunch of combos using directory/path, not sure if im missing something obvious, but this appears to be how its done here: https://github.com/facebook/osquery/blob/master/packs/osx-attacks.conf#L217