I'm trying to check if MalwareBytes realtime protection is enabled with the following query:

SELECT f.path FROM file AS f JOIN mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemFSName == '<http://product.info|product.info>' && kMDItemTextContent == 'off'" WHERE f.path = "/Library/Application Support/Malwarebytes/MBAM/LogsEx/product.info";

If I remove

kMDItemTextContent

I get results:

SELECT f.path FROM file AS f JOIN mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemFSName == '<http://product.info|product.info>'" WHERE f.path = "/Library/Application Support/Malwarebytes/MBAM/LogsEx/product.info";
+--------------------------------------------------------------------+
| path                                                               |
+--------------------------------------------------------------------+
| /Library/Application Support/Malwarebytes/MBAM/LogsEx/product.info |
+--------------------------------------------------------------------+

I see this with grep

$ grep off /Library/Application\ Support/Malwarebytes/MBAM/LogsEx/product.info
    "actual" : "off(reason: notAllowedBySystem)",
    "actual" : "off(reason: notAllowedBySystem)",

Does that mean the metadata is only being indexed by spotlight but not the contents here? This used to work so I'm guessing something changed in the last major MacOS update. Any thoughts on a possible workaround here? Thanks!