Q: If I create a custom attack pack like testpack.conf and co-locate with the others, is it as simple as adding that new path to the osquery.conf file? Or am i missing steps?

That ought to do it.