(http://www.intego.com/mac-security-blog/os-x-malware-tibet-variant-found/): Artifact used by this malware
Query:
select * from launchd where path like '%com.apple.AudioService.plist';Additional Query Info:
Version: 1.4.5
Platform: darwin
Interval: 3600
JSON:
{ "queries": { "Tibet.D": { "query" : "select * from launchd where path like '%com.apple.AudioService.plist';", "interval" : "3600", "platform" : "darwin", "version": "1.4.5", "description" : "(http://www.intego.com/mac-security-blog/os-x-malware-tibet-variant-found/)", "value" : "Artifact used by this malware" } } }