long time lurker but did anyone see - https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ - should be easy to turn add this to the osx-attacks pack with the query of

"Quimitchin": {
  "query" : "select * from launchd where name = 'com.client.client.plist';",
  "interval" : "86400",
  "description" : "(<https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/>)",
  "value" : "Artifact used by this malware"
}