Name: OSX_Backdoor_Mokes
(https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/): Artifact used by this malware

Query:

select * from file where \
        path LIKE '/Users/%/Library/App Store/storeuserd' OR \
        path LIKE '/Users/%/Library/com.apple.spotlight/SpotlightHelper' OR \
        path LIKE '/Users/%/Library/Dock/com.apple.dock.cache' OR \
        path LIKE '/Users/%/Library/Dropbox/DropboxCache' OR \
        path LIKE '/Users/%/Library/Skype/SkypeHelper' OR \
        path LIKE '/Users/%/Library/Google/Chrome/nacld' OR \
        path LIKE '/Users/%/Library/Firefox/Profiles/profiled';

Additional Query Info:
Version: 1.4.5
Platform: darwin
Interval: 3600

JSON:

{
  "queries": {
    "OSX_Backdoor_Mokes": {
      "query" : "select * from file where \
        path LIKE '/Users/%/Library/App Store/storeuserd' OR \
        path LIKE '/Users/%/Library/com.apple.spotlight/SpotlightHelper' OR \
        path LIKE '/Users/%/Library/Dock/com.apple.dock.cache' OR \
        path LIKE '/Users/%/Library/Dropbox/DropboxCache' OR \
        path LIKE '/Users/%/Library/Skype/SkypeHelper' OR \
        path LIKE '/Users/%/Library/Google/Chrome/nacld' OR \
        path LIKE '/Users/%/Library/Firefox/Profiles/profiled';",
      "interval" : "3600",
      "platform" : "darwin",
      "version": "1.4.5",
      "description" : "(https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/)",
      "value" : "Artifact used by this malware"
    }
  }
}