<dict>
        <key>Description</key>
        <string>OSX.Bundlore.D</string>
        <key>LaunchServices</key>
        <dict>
                <key>LSItemContentType</key>
                <string>com.apple.application-bundle</string>
        </dict>
        <key>Matches</key>
        <array>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>46617364554153</string>
                </dict>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>20006500630068006F002000</string>
                </dict>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>20007C0020006F00700065006E00730073006C00200065006E00630020002D006100650073002D003200350036002D0063006600620020002D007000610073007300200070006100730073003A</string>
                </dict>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>002D00730061006C00740020002D00410020002D00610020002D00640020007C002000620061007300680020002D0073</string>
                </dict>
        </array>
</dict>

<key>JavaWebComponentVersionMinimum</key>
<string>1.6.0_45-b06-451</string>
<key>PlugInBlacklist</key>
<dict>
        <key>10</key>
        <dict>
                <key>com.apple.java.JavaAppletPlugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>14.8.0</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.apple.java.JavaPlugin2_NPAPI</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>14.8.0</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.macromedia.Flash Player ESR.plugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>18.0.0.382</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.macromedia.Flash Player.plugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>32.0.0.101</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.microsoft.SilverlightPlugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>5.1.41212.0</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.oracle.java.JavaAppletPlugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>1.8.51.16</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
        </dict>
</dict>

rule XProtect_MACOS_SLEEPYSTEGOSAURUS_SYM {
    meta:
        description = "MACOS.SLEEPYSTEGOSAURUS.SYM"
        uuid = "BB4F7D16-C939-4047-A9AF-E74E7B51FAC1"
    strings:
        $a1 = { 45 78 65 63 43 6D 64 }
        $a2 = { 47 65 74 48 6F 73 74 49 6E 66 6F }
        $a3 = { 52 75 6E 53 63 72 69 70 74 }
        $a4 = { 52 75 6E 53 63 72 69 70 74 55 72 6C }
        $a5 = { 4C 61 75 6E 63 68 50 6C 69 73 74 }
        $a6 = { 43 68 65 63 6B 50 72 6F 63 65 73 73 }
        $a7 = { 43 68 65 63 6B 49 6E }
        $a8 = { 52 75 6E 43 6D 64 46 69 6C 65 }
        $a9 = { 53 68 6F 77 48 74 6D 6C }
        $a10 = { 50 6C 69 73 74 48 65 6C 70 65 72 }
        $a11 = { 4C 61 75 6E 63 68 64 48 65 6C 70 65 72 }
        $a12 = { 43 6F 6D 6D 61 6E 64 46 69 6C 65 }
        $a13 = { 57 72 69 74 65 50 6C 69 73 74 }
        $a14 = { 4A 53 4F 4E 46 69 6C 65 50 72 6F 63 65 73 73 6F 72 }
        $a15 = { 43 68 72 6F 6D 65 48 65 6C 70 65 72 }
        $a16 = { 53 61 6E 64 62 6F 78 65 72 }
    condition:
        Macho and filesize < 2MB and all of them
}

jbo@McJbo ~ $ sqlite3 "/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/gk.db" .schema
CREATE TABLE settings (name TEXT, value TEXT, PRIMARY KEY (name));
CREATE TABLE blocked_hashes (hash BLOB, hash_type INTEGER, flags INTEGER, PRIMARY KEY (hash, hash_type));
CREATE TABLE blocked_teams (team_id TEXT, flags INTEGER, PRIMARY KEY (team_id));
jbo@McJbo ~ $ sqlite3 "/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/gk.db" "SELECT * FROM blocked_teams LIMIT 5;"
F9X83Q5222|1
Q6XAB4776L|0
DK5C9Y86C8|0
8VK2WEPW22|0
5LWMEF3EX3|0
jbo@McJbo ~ $

jbo@McJbo ~ $ ls -l /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/
total 47256
-rwxr-xr-x  1 root  wheel   513696 Feb 27 16:54 XProtect
-rwxr-xr-x  1 root  wheel  2498784 Feb 27 16:54 XProtectRemediatorAdload
-rwxr-xr-x  1 root  wheel  2367952 Feb 27 16:54 XProtectRemediatorBadGacha
-rwxr-xr-x  1 root  wheel  2053968 Feb 27 16:54 XProtectRemediatorBlueTop
-rwxr-xr-x  1 root  wheel  2332752 Feb 27 16:54 XProtectRemediatorBundlore
-rwxr-xr-x  1 root  wheel  2299648 Feb 27 16:54 XProtectRemediatorCardboardCutout
-rwxr-xr-x  1 root  wheel  2333248 Feb 27 16:54 XProtectRemediatorColdSnap
-rwxr-xr-x  1 root  wheel  2052736 Feb 27 16:54 XProtectRemediatorCrapyrator
-rwxr-xr-x  1 root  wheel  2859040 Feb 27 16:54 XProtectRemediatorDolittle
-rwxr-xr-x  1 root  wheel  2205520 Feb 27 16:54 XProtectRemediatorDubRobber
-rwxr-xr-x  1 root  wheel  2334752 Feb 27 16:54 XProtectRemediatorEicar
-rwxr-xr-x  1 root  wheel  2053120 Feb 27 16:54 XProtectRemediatorFloppyFlipper
-rwxr-xr-x  1 root  wheel  2053616 Feb 27 16:54 XProtectRemediatorGenieo
-rwxr-xr-x  1 root  wheel  2053504 Feb 27 16:54 XProtectRemediatorGreenAcre
-rwxr-xr-x  1 root  wheel  2332800 Feb 27 16:54 XProtectRemediatorKeySteal
-rwxr-xr-x  1 root  wheel  4659088 Feb 27 16:54 XProtectRemediatorMRTv3
-rwxr-xr-x  1 root  wheel  2382448 Feb 27 16:54 XProtectRemediatorPirrit
-rwxr-xr-x  1 root  wheel  2333024 Feb 27 16:54 XProtectRemediatorRankStank
-rwxr-xr-x  1 root  wheel  2299728 Feb 27 16:54 XProtectRemediatorRoachFlight
-rwxr-xr-x  1 root  wheel  2384416 Feb 27 16:54 XProtectRemediatorSheepSwap
-rwxr-xr-x  1 root  wheel  2053232 Feb 27 16:54 XProtectRemediatorSnowBeagle
-rwxr-xr-x  1 root  wheel  2350624 Feb 27 16:54 XProtectRemediatorSnowDrift
-rwxr-xr-x  1 root  wheel  2019712 Feb 27 16:54 XProtectRemediatorToyDrop
-rwxr-xr-x  1 root  wheel  2105696 Feb 27 16:54 XProtectRemediatorTrovi
-rwxr-xr-x  1 root  wheel  2332768 Feb 27 16:54 XProtectRemediatorWaterNet
jbo@McJbo ~ $

<key>com.apple.XProtect.PluginService.agent.slow.scan</key>
<dict>
        <key>Repeating</key>
        <true/>
        <key>PowerNap</key>
        <true/>
        <key>CPUIntensive</key>
        <true/>
        <key>DiskIntensive</key>
        <true/>
        <key>AllowBattery</key>
        <false/>
        <key>Priority</key>
        <string>Utility</string>
        <key>Interval</key>
        <integer>604800</integer>
</dict>

import sys,base64;exec(base64.b64decode('
import sys,base64,warnings;warnings.filterwarnings('ignore');exec(base64.b64decode('
import sys;import re, subprocess;cmd = "ps -ef | grep Little\ Snitch | grep -v grep"

def macos_xprotect_string_decryption(encrypted: bytes, encr_key: int) -> str:
    """
    Author: @Check Point Research
    Decrypts MacOS Xprotect binaries & Banshee Stealer encrypted strings.
    """
    decrypted = "".join(
        chr(
            (encr_key >> ((i * 8) & 0x38) & 0xFF) ^ encrypted[i]
        )
        for i in range(len(encrypted))
    )
    return decrypted.partition("\\x00")[0]

10000592a      if (data_1000ffe7e != 0)
10000592c          void* rax_1 = &data_1000fb0a0
100005933          int64_t i = 0
100005951          do
100005940              *rax_1 = *rax_1 ^ (0x363a34363a303900 u>> (i.b & 0x38)).b
100005943              i = i + 8
100005947              rax_1 = rax_1 + 1
100005951          while (i != 0x26ef0)
100005953          data_1000ffe7e = 0