I did a quick blog post following up on Patrick Wardle’s latest macOS malware for using osquery to find what he’s calling OSX/MaMi (it currently is only found by 2 engines on VirusTotal). It’s two simple but fairly solid IOCs. https://medium.com/uptycs/finding-osx-mami-with-osquery-72960eee0190 Let me know if folks think this is worthy of being added to https://github.com/facebook/osquery/blob/master/packs/osx-attacks.conf — if so, I’ll do that after lunch.