✄𐘗
text code block:
✄𐘗from logs-endpoint.events.file-* METADATA _id, _index, _version
| WHERE host.os.type == "macos"
    AND event.type != "deletion"
    AND process.name == "SSFileCopyReceiver"
    AND (
        file.path LIKE "/Library/LaunchDaemons/*.plist"
        OR file.path LIKE "/Library/LaunchAgents/*.plist"
        OR file.path LIKE "/Users/*/Library/LaunchAgents/*.plist"
        OR file.path LIKE "/private/var/*/Library/LaunchAgents/*.plist"
        OR file.name IN (".zshenv", ".zshrc", ".zprofile", ".zlogin", ".bashrc", ".bash_profile", ".bash_login", ".profile", "config.fish", "environment.plist")
        OR file.path LIKE "/Users/*/.ssh/authorized_keys"
        OR file.path LIKE "/private/var/root/.ssh/authorized_keys"
        OR file.path LIKE "/private/etc/ssh/sshd_config*"
        OR file.path LIKE "/private/var/at/tabs/*"
        OR file.path LIKE "/var/at/tabs/*"
        OR file.path LIKE "/private/var/root/.*/*"
        OR file.path LIKE "/var/root/.*/*"
        OR file.path LIKE "/private/var/root/.*"
        OR file.path LIKE "/var/root/.*"
    )
| KEEP _id, _index, _version, 
    @timestamp, host.name, host.id, user.id, user.name, process.name, 
    event.action, event.type, file.path, file.name, data_stream.namespace