WireLurker

select * from launchd where \\
        name = 'com.apple.machook_damon.plist' OR \\
        name = 'com.apple.globalupdate.plist' OR \\
        name = 'com.apple.appstore.plughelper.plist' OR \\
        name = 'com.apple.MailServiceAgentHelper.plist' OR \\
        name = 'com.apple.systemkeychain-helper.plist' OR \\
        name = 'com.apple.periodic-dd-mm-yy.plist';
View Full Query Details

XcodeGhost

select * from ( \\
        select apps.bundle_short_version as xcode_version, \\
          apps.path as xcode_path, \\
          file.path, \\
          file.type as file_type \\
        from apps, file \\
        where apps.bundle_name='Xcode' and \\
          file.path like (apps.path || '/Contents/Developer/Platforms/%/Developer/SDKs/Library/%%') \\
      ) join hash using (path) where file_type = 'regular';
View Full Query Details

Zk Rootkit

select * from file where path in ('/usr/share/.zk', '/usr/share/.zk/zk', '/etc/1ssue.net', '/usr/X11R6/.zk', '/usr/X11R6/.zk/xfs', '/usr/X11R6/.zk/echo', '/etc/sysconfig/console/load.zk');
View Full Query Details