Name: efi_file_hashes
Hash files related to EFI platform updates and EFI bootloaders on primary boot partition. This does not hash bootloaders on the EFI/boot partition.:

Query:

select file.path, uid, gid, mode, 0 as atime, mtime, ctime, md5, sha1, sha256 from (select * from file where path like '/System/Library/CoreServices/%.efi' union select * from file where path like '/System/Library/LaunchDaemons/com.apple%efi%') file join hash using (path);

Additional Query Info:
Version: 1.6.1
Platform: darwin
Interval: 7200

JSON:

{
  "queries": {
    "efi_file_hashes": {
      "query" : "select file.path, uid, gid, mode, 0 as atime, mtime, ctime, md5, sha1, sha256 from (select * from file where path like '/System/Library/CoreServices/%.efi' union select * from file where path like '/System/Library/LaunchDaemons/com.apple%efi%') file join hash using (path);",
      "interval" : "7200",
      "platform" : "darwin",
      "version": "1.6.1",
      "description" : "Hash files related to EFI platform updates and EFI bootloaders on primary boot partition. This does not hash bootloaders on the EFI/boot partition.",
      "value" : ""
    }
  }
}