Weekly Threat Advisory: Drive-By Domain Surge + 9 Concurrent Ransomware Operators (Aug 3-9, 2026)

Drive-by and ransomware week. A single drive-by fake-update campaign produced 371 attacker-registered domains — the largest single-campaign domain footprint of the cycle. Concurrently: twelve ransomware operators active in parallel, an info-stealer and credential-drainer surge spanning Windows and macOS, third consecutive week of macOS-native multi-family activity, and continued supply-chain wave targeting the developer ecosystem.

1,999 unique high-confidence indicators across 116 tracked clusters. 87% High-severity — the intelligence this cycle is concentrated on high-confidence signals rather than commodity noise. Sectioned for the working analyst: aggregate volumes, cluster-category footprint, ATT&CK tactic-pressure roll-up, top IOCs per indicator type, four production-ready Sigma rules, real-world hunting lessons, and a 60-minute operationalisation plan. Vendor-neutral. Operator-grade. Archive of prior advisories.

01 · This week in numbers

1,999 unique high-confidence indicators across 116 tracked clusters this cycle. Volume is deliberately narrow — the catalogue this cycle filtered to the weekly-classified feed tier, prioritising high-signal indicators over commodity noise. This is why 87% of indicators are High-severity (vs 3% in prior weeks that included framework-C2 background). Domain volume dominates at 40% of the feed — driven by the drive-by fake-update campaign registering 371 domains.

02 · Five headlines — what defined this cycle

Headline 01 · Drive-by fake-update wave — 371 attacker-registered domains

The dominant story of the cycle. A single drive-by fake-update malware campaign produced 371 attacker-registered domains this week alone — the largest single-campaign domain footprint of the cycle by a wide margin. Every domain follows a similar structural pattern (random-string subdomain + compromised legitimate site, e.g. [a-z0-9]{8}.[compromised-site].[tld]), suggesting an automated infrastructure-provisioning pipeline. The campaign delivers browser-render-time payloads via legitimate-appearing site compromise + injected fake-update prompts.

Defensive answer: web-proxy content-inspection for the domain-pattern regex; block downloads of .exe, .msi, .dmg, .pkg when the download source is a newly-registered subdomain of a low-reputation parent domain; alert on any “update your browser” download-prompt patterns.

Headline 02 · Twelve concurrent ransomware operators active

Twelve distinct ransomware families produced fresh IOCs this cycle — the highest concurrent-ransomware-operator count catalogued in recent weeks. Combined ransomware-category footprint: 335+ IOCs across twelve operators. Signature patterns include one operator with 27 IOCs at High severity (established RaaS reactivation), a crypto-brand-themed ransomware operator (15 IOCs), and multiple mid-tier operators at 8-18 IOCs each. TOR-based negotiation-portal infrastructure is the common thread — standard RaaS operational pattern.

Defensive answer: ensure endpoint detection includes recent ransomware-family signatures + universal behavioural detectors (mass file-encryption, shadow-copy deletion via vssadmin, service-stop patterns, backup-service kill patterns). If backups are not immutable or air-gapped, address this week regardless of any other signal.

Headline 03 · Info-stealer + credential-drainer surge across platforms

Multiple info-stealer and credential-drainer families active concurrently. One dominant info-stealer family produced 181 IOCs with full 4-type IOC coverage (DOMAIN + HASH + IP + URL). A macOS-native info-stealer / credential-drainer pair produced 17 IOCs. A macOS crypto-drainer variant added another 7 IOCs. The pattern reflects operator investment in credential-monetisation — browser session cookies, password-store data, cryptocurrency wallets. Cross-platform coverage (Windows + macOS) is increasingly the norm, not the exception.

Defensive answer: harden browser credential-store access controls (require re-auth for sensitive credential retrieval); MFA on all cryptocurrency-adjacent accounts; endpoint EDR coverage on macOS not optional.

Headline 04 · macOS multi-family surge continues

Third consecutive week of macOS-native multi-family activity. Combined footprint: 118 IOCs across three macOS-native families. One larger cross-platform family with a v4 evolution (77 IOCs across all 4 IOC types), one macOS info-stealer / credential-drainer pair (17 IOCs), one macOS crypto-drainer (7 IOCs). The concurrent-family pattern across three consecutive weeks establishes macOS as a validated adversary-attention target — the ecosystem is telling defenders that under-investment in macOS EDR coverage is being actively exploited.

Defensive answer: confirm EDR coverage across all macOS endpoints without exceptions. Verify endpoint detection includes recent macOS TCC-bypass, LaunchAgent + LaunchDaemon persistence, dylib-injection, and unsigned-binary-from-user-writable-path patterns.

Headline 05 · Supply-chain wave continues — developer ecosystem targeting

The developer-ecosystem supply-chain wave carries into a second week. Fresh signals this cycle: a malicious-package registry campaign (19 IOCs across three IOC types) and a fake developer-marketplace extension campaign (10 IOCs). Combined with the prior week’s fake-installer + fake-AI-assistant campaigns, this establishes the pattern: developer-tooling supply-chain attacks are not a one-off — they are a sustained operator investment. Blast radius per compromised developer remains disproportionate.

Defensive answer: mail-gateway policy blocking untrusted installer attachments to developer subnets; endpoint-detection allowlist for developer-tooling installer signers only; audit package-manager lock-files for unexpected new-source dependencies; audit code-signing key access patterns.

03 · Indicator type, severity, and category mix

Domain dominance at 40% share is unusual and signals infrastructure-heavy campaign activity — typical baseline is 5-10% domain share. URL share at 22% and Hash share at 14% are also elevated. Severity distribution: 87% High-severity because the weekly-tier feed prioritises high-confidence signals over commodity noise. Category dominance: Malware-Activity at 42.5% share, Ransomware-as-a-service at 10%.

By indicator type

By severity

By category

04 · Cluster footprint — ranked by unique-IOC count

56 clusters ranked by unique IOC footprint (14 newly-added since initial publish). Framework-infrastructure entries shown in grey to preserve visual clarity of the campaign-attributed clusters. All labels sanitised into category descriptors.

05 · Themed deep-dives

05.1 · The 371-domain drive-by fake-update campaign

The dominant signal of the cycle. A single drive-by fake-update malware campaign registered 371 attacker-controlled domains this week. Structural pattern: [a-z0-9]{8}.[compromised-site].[tld] — a random-string subdomain hosted on a compromised legitimate parent site. The delivery chain: user visits legitimate-looking site → injected script triggers fake browser-update prompt → user clicks “update” → payload downloads from the attacker-controlled subdomain → execution.

Why 371 domains? Automation. The campaign has an infrastructure-provisioning pipeline that generates + registers new lookalike subdomains at scale. Blocking any individual domain has zero durable defensive value — the operator provisions a replacement within hours. The defensive answer must operate on the pattern, not the individual domains.

Defensive actions:

• Web-proxy regex block on the subdomain-pattern signature: random-string of 6-10 characters preceding a compromised-site TLD.
• Alert on any download of .exe, .msi, .dmg, .pkg from a subdomain younger than 30 days.
• Browser-plane hardening: disable automatic download prompts; require user confirmation for any file-type download.
• User-awareness bulletin: legitimate browser updates come from the browser itself, not from a website prompting you to click.

05.2 · Twelve concurrent ransomware operators

Twelve ransomware families active in parallel this cycle. Combined footprint: 335+ IOCs across twelve operators. Composition:

• One established RaaS operator resurfaced at High severity (27 IOCs) — affiliate-program reactivation signal.
• Mid-tier operators active at 8-18 IOCs each (six operators in this band).
• One crypto-brand-themed operator (15 IOCs) — social-engineering pattern targeting cryptocurrency-adjacent audiences.
• One threat-actor / ransomware hybrid operator (11 IOCs) using both ransomware and other tooling.

Common infrastructure pattern: TOR-based negotiation portals. This is the standard RaaS pattern — the URL indicators are .onion addresses for victim negotiation.

Defensive actions: ensure endpoint detection includes recent ransomware-family signatures + universal behavioural detectors (mass file-encryption, shadow-copy deletion via vssadmin, service-stop patterns, backup-service kill patterns). Immutable and air-gapped backups are non-negotiable given twelve concurrent operators.

05.3 · Info-stealer + credential-drainer surge across platforms

Multiple concurrent info-stealer and credential-drainer families this cycle. Signals:

• One dominant info-stealer family with full 4-type IOC coverage (181 IOCs across DOMAIN + HASH + IP + URL) — the mature-infrastructure signal.
• A macOS-native info-stealer + credential-drainer pair (17 IOCs).
• A macOS crypto-drainer variant (7 IOCs).
• A cross-platform crypto-drainer family (7 IOCs across three IOC types).

The pattern reflects operator investment in credential-monetisation — browser session cookies, password-store data, cryptocurrency wallet keys. Cross-platform coverage (Windows + macOS) is increasingly the default.

Defensive actions: harden browser credential-store access (require re-auth for sensitive credential retrieval); MFA on all cryptocurrency-adjacent accounts; endpoint EDR coverage on macOS is not optional; consider FIDO2 hardware keys for privileged accounts.

05.4 · macOS multi-family surge — third consecutive week

Third consecutive week of macOS-native multi-family activity. Combined footprint this week: 118 IOCs across three macOS-native families. One larger cross-platform family with a v4 evolution, one macOS info-stealer / credential-drainer pair, one macOS crypto-drainer. When multiple independent operators concurrently target the same profile across three consecutive weeks, the ecosystem is telling defenders that under-investment in the profile is being validated as an exploitable gap.

Defensive actions: confirm EDR coverage across all macOS endpoints without exceptions (design, engineering, executive laptops, creative teams). Verify endpoint detection includes recent macOS-specific patterns: TCC-bypass attempts, LaunchAgent + LaunchDaemon persistence, dylib-injection, unsigned-binary execution from user-writable paths, crypto-wallet file access from unfamiliar processes.

05.5 · Supply-chain wave continues — developer ecosystem

The developer-ecosystem supply-chain wave carries into a second week. Fresh signals: a malicious-package registry campaign (19 IOCs across three IOC types), a fake developer-marketplace extension campaign (10 IOCs), and a multi-stage supply-chain campaign (7 IOCs). Combined with the prior week’s fake-installer and fake-AI-assistant campaigns, the pattern is established: developer-tooling supply-chain attacks are a sustained operator investment, not a one-off.

Defensive actions: mail-gateway policy blocking untrusted installer attachments to developer subnets; endpoint-detection allowlist for developer-tooling installer signers only; audit package-manager lock-files for unexpected new-source dependencies (recent additions of packages from unfamiliar publishers deserve review); audit code-signing key access patterns; consider requiring MFA-gated approval for new package additions in critical repositories.

05B · Adversary analytics — technique, geography, sector

Beyond the specific IOCs and cluster footprints, three cross-cutting analytics tell the story of adversary intent this cycle: which techniques are most prevalent across all clusters, which countries the intelligence signals are most likely targeting, and which sectors carry the highest concurrent-target attention. All three are extracted from this cycle’s full catalogue (not just the weekly-filtered high-confidence tier).

05B.1 · Top techniques (ATT&CK)

The single most-used technique this cycle: T1105 · Ingress Tool Transfer at 998 hits — the universal second-stage-payload-pull technique that appears in almost every multi-stage cluster. When ~1 in 4 attributed IOCs maps to T1105, the defensive answer is content-inspection at the network egress + endpoint download layer, not per-family signatures.

05B.2 · Most-common targeted countries

The most-targeted country this cycle: Germany (628 attributions), followed closely by the United States (760, combined representations), France (563), the United Kingdom (531), Canada (515), India (505), and Australia (484). The distribution is unusually even across the top-7 countries — a Five-Eyes + Western-Europe + India profile that suggests broad-audience campaigns (drive-by wave, info-stealer wave) rather than surgical geographic targeting.

05B.3 · Most-common targeted sectors

The most-targeted sector this cycle: Technology (902 attributions), essentially tied with Manufacturing (880), Government (877), Healthcare (877), and Financial Services (873). Same broad-target signature as the country distribution — the top-5 sectors all sit inside a ~30-attribution band. This is consistent with commodity-tier campaign activity (drive-by, info-stealer, ransomware) that targets any sector with monetisable exposure. Retail, Telecommunications, and Education round out the top-8 with substantial volume.

Reading the three dimensions together. Top technique = Ingress Tool Transfer (universal second-stage). Top country = Germany (broad Western + India + Australia distribution). Top sector = Technology (essentially tied with 4 other sectors in the top-5). All three signals point to the same conclusion: this cycle’s adversary attention is broad, not narrow. High-volume commodity campaigns hitting the widest possible audience across industries and geographies. The defensive answer for a broad-target cycle is signature-level content and behavioural detectors that catch the pattern regardless of who runs it.

06 · ATT&CK tactic-pressure roll-up

Detection-engineering takeaway. Initial Access is the dominant pressure this cycle at 495 IOCs, driven overwhelmingly by drive-by compromise (T1189). This is the highest drive-by pressure catalogued in recent weeks. Impact tactics (T1486 ransomware encryption, T1489 / T1490 service stop + inhibit recovery) are elevated with twelve concurrent ransomware operators. Credential Access is elevated (340 IOCs) driven by the info-stealer surge — browser password-store theft is the dominant sub-technique. Resource Development (T1583.001 adversary-acquired domains) at 495 IOCs reflects the 371-domain drive-by campaign infrastructure footprint.

07 · Real-world threat intelligence lessons

Beyond the specific IOCs, this cycle’s data carries lessons that will still matter next month and next quarter. Below are the pragmatic takeaways for the working analyst.

Lesson 01 · When one campaign owns 40% of your feed, pattern detection beats individual-IOC blocking

The 371-domain drive-by campaign accounted for 40% of this week’s domain volume. Blocking any single one of those 371 domains has zero durable defensive value — the operator has an infrastructure-provisioning pipeline that generates replacements faster than any feed can catalogue them. The mature CTI program detects the pattern (subdomain-format regex, subdomain-age enrichment, parent-domain-reputation join) and treats individual IOCs as evidence-of-pattern, not as primary blocklist entries. Reallocate feed-consumption architecture accordingly.

Lesson 02 · Twelve concurrent ransomware operators means backups are the perimeter

When nine ransomware operators are simultaneously active, the probability that at least one gets past your prevention controls in any given quarter approaches certainty. The perimeter defence is not endpoint detection alone — it is the recovery capability if endpoint detection misses. Immutable backups. Air-gapped backups. Tested restore procedures. If your restore has not been tested against a full-domain-encrypted scenario in the last 90 days, it has not been tested.

Lesson 03 · Cross-platform info-stealers mean the browser is the credential vault attackers care about

The dominant info-stealer family this cycle has full 4-type IOC coverage. Multiple macOS-native stealers are active concurrently. The consistent target: browser credential stores, cookies, cryptocurrency wallet files. This is where operator monetisation happens. The defensive answer: harden browser credential retrieval (require re-auth), move privileged secrets out of browser storage (use dedicated password managers with hardware-token unlocking), enforce FIDO2 hardware keys on all high-value accounts.

Lesson 04 · The developer ecosystem is not a temporary target

Two consecutive weeks of supply-chain campaigns targeting developer tooling. This is not a one-off — it is a validated operator investment area. Developer machines carry disproportionate blast radius: cloud credentials, code-signing keys, CI/CD pipeline access, package-registry publish tokens. The defensive answer is not just endpoint-level content on developer machines — it is CI/CD-pipeline hygiene (secret rotation, dependency-provenance verification, package-lock audits) and identity-plane hardening (MFA on all developer accounts, session-lifetime restrictions, privileged-access review).

Lesson 05 · macOS coverage is a growing operational gap

Three consecutive weeks of macOS multi-family activity establishes the pattern: operators are validating macOS as an exploitable gap. Environments that still treat macOS EDR as optional or best-effort are the environments this pattern is designed to exploit. Confirm EDR coverage across all macOS endpoints. Confirm coverage includes recent macOS-specific persistence patterns. Confirm your SOC can triage macOS alerts (analyst training on macOS-specific artefacts is often the missing piece).

Lesson 06 · High-severity concentration signals mature intelligence, not more threat

87% High-severity this week is not because the threat landscape got 30x worse. It is because the weekly-tier feed prioritises high-confidence signals over commodity noise. A mature CTI program uses this signal: the weekly-tier feed is where you look for actionable intelligence; the higher-volume feeds are where you look for context and enrichment on specific alerts. Do not treat all feed tiers as equal — they serve different analytical purposes.

The one-line synthesis. This week says: pattern-detection beats individual-blocking for high-volume campaigns; backup recovery is now the last line of defence against ransomware; browser credential-store hardening is table stakes; developer-ecosystem targeting is not going away; macOS EDR coverage is an active gap; feed tiering is an analytical tool. Six takeaways from one week that will still be true next quarter.

08 · Top IOCs per indicator type

Operator-grade extractions with category and severity attribution only. All indicators are defanged (re-fang on import: [.] → . and hxxp → http).

Top 15 · IP addresses (High severity)

Top domains (High severity)

Top file hashes (High severity)

Top URLs (High severity)

09 · Sigma detection rules

Sigma 01 · Drive-by fake-update chain (HIGH)

title: Drive-By Fake-Update Chain — Random-Subdomain Download of Installer
id: 4f2a8d6c-7b53-4820-9a71-3f5c1e2d8a41
status: experimental
description: Detects the drive-by fake-update chain — user browsing session
  leads to a download of an installer file (.exe, .msi, .dmg, .pkg) from a
  random-string subdomain of a low-reputation parent domain. Ships from
  HackForLab weekly threat advisory Aug 3-9, 2026.
references:
  - https://hackforlab.com/weekly-threat-advisory-august-3-9-2026/
author: HackForLab Threat Intelligence
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1189
  - attack.execution
  - attack.t1204.002
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: web_proxy
detection:
  s1_random_subdomain:
    destination_host|re: '^[a-z0-9]{6,10}\.[a-z0-9-]+\.[a-z]{2,10}$'
  s2_installer_download:
    request_uri|endswith:
      - '.exe'
      - '.msi'
      - '.dmg'
      - '.pkg'
      - '.deb'
    request_method: 'GET'
    response_content_type|contains:
      - 'application/octet-stream'
      - 'application/x-msi'
      - 'application/x-apple-diskimage'
  s3_low_reputation_parent:
    destination_parent_domain_age: '<30d'
    OR destination_parent_domain_reputation: 'unknown'
  condition: s1_random_subdomain and s2_installer_download and s3_low_reputation_parent
falsepositives:
  - Legitimate software installers from allowlisted publishers (maintain publisher allowlist)
level: high

Sigma 02 · Universal ransomware behaviour (CRITICAL)

title: Universal Ransomware Behaviour — Mass Encrypt + Shadow-Copy Delete
id: 5c9e7b2d-1a83-4550-b721-3f9b6d4f2a15
status: experimental
description: Detects universal ransomware behaviour — mass file-modification
  with new extensions + shadow-copy deletion + backup-service stop within a
  short window. Catches all twelve concurrent ransomware operators this cycle
  without requiring family-specific signatures.
references:
  - https://hackforlab.com/weekly-threat-advisory-august-3-9-2026/
author: HackForLab Threat Intelligence
date: 2026/08/10
tags:
  - attack.impact
  - attack.t1486
  - attack.t1490
  - attack.t1489
logsource:
  product: correlation
detection:
  s1_mass_file_modify:
    EventCount|file_modify_events: '>100_per_minute'
    NewFileExtension|distinct_count: '<3'
  s2_shadow_copy_delete:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set recoveryenabled No'
  s3_backup_service_stop:
    Service|category: 'backup_or_shadowcopy'
    ServiceAction: 'stop_or_disable'
  condition: (s1_mass_file_modify and s2_shadow_copy_delete)
          or (s1_mass_file_modify and s3_backup_service_stop)
level: critical

Sigma 03 · Info-stealer credential-store read + exfil (HIGH)

title: Info-Stealer Chain — Browser Credential-Store Read + Outbound POST
id: 6a5e9d3f-7b28-4c50-a941-5f8b6d2e9c32
status: experimental
description: Detects the info-stealer chain — read access to browser
  credential-store paths by a non-browser process, followed within 5 minutes
  by outbound POST to a non-corporate destination with payload larger than
  50 KB. Catches this cycle's dominant info-stealer + credential-drainer
  families across Windows and macOS.
references:
  - https://hackforlab.com/weekly-threat-advisory-august-3-9-2026/
author: HackForLab Threat Intelligence
date: 2026/08/10
tags:
  - attack.credential_access
  - attack.t1003
  - attack.t1555
  - attack.t1539
  - attack.exfiltration
  - attack.t1041
logsource:
  product: correlation
detection:
  s1_credential_store_read:
    EventType: 'file_read'
    TargetPath|contains:
      - '\User Data\Default\Login Data'
      - '\User Data\Default\Cookies'
      - '/Library/Application Support/Google/Chrome/Default/Login Data'
      - '/Library/Application Support/Firefox/Profiles'
      - '/Library/Keychains/'
    ReaderProcess|not:
      - 'browser_processes_allowlist'
  s2_outbound_post:
    RequestMethod: 'POST'
    DestinationIp|expand: '%non_corporate_destinations%'
    RequestBodySize: '>50000'
  condition: s1_credential_store_read and s2_outbound_post within 5m
falsepositives:
  - Legitimate password manager sync (allowlist by known-good sync destinations)
level: high

Sigma 04 · macOS LaunchAgent / Daemon persistence (HIGH)

title: macOS Persistence — LaunchAgent or LaunchDaemon plist Write by Non-Allowlisted Signer
id: 5d8e9c1f-3b47-4a52-a831-6f2b7c1d9a53
status: experimental
description: Detects LaunchAgent or LaunchDaemon plist file writes to
  user-writable paths on macOS endpoints by a process whose signer is not
  on the allowlist. Catches this cycle's macOS multi-family activity
  (third consecutive week of the pattern).
references:
  - https://hackforlab.com/weekly-threat-advisory-august-3-9-2026/
author: HackForLab Threat Intelligence
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1543.001
  - attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  s1_launch_persistence_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
      - '~/Library/LaunchAgents/'
    TargetFilename|endswith: '.plist'
  s2_writer_not_allowlisted:
    ProcessSigner|not:
      - 'os_vendor'
      - 'allowlisted_mac_publisher'
  condition: s1_launch_persistence_path and s2_writer_not_allowlisted
falsepositives:
  - Legitimate third-party tooling with allowlisted signers (maintain allowlist)
level: high

10 · Hunt queries — SIEM-agnostic pseudo-syntax

Hunt 01 · Drive-by installer downloads from random-subdomain patterns (last 30 days)

FROM web_proxy
WHERE destination_host REGEXP '^[a-z0-9]{6,10}\.[a-z0-9-]+\.[a-z]{2,10}$'
  AND request_uri REGEXP '\.(exe|msi|dmg|pkg|deb)$'
  AND destination_parent_domain_age < 30 DAYS
  AND event_time >= NOW() - 30 DAYS
| PROJECT source_host, destination_host, request_uri, event_time
| SORT BY event_time DESC

Hunt 02 · Ransomware behavioural triage (last 30 days)

FROM edr_file_events
WHERE event_type = 'modify'
  AND file_modification_rate > 100_per_minute
  AND new_file_extension_distinct_count < 3
  AND event_time >= NOW() - 30 DAYS
| JOIN edr_process_create pc ON pc.host = file_events.host
| WHERE pc.command_line CONTAINS 'vssadmin' OR pc.command_line CONTAINS 'shadowcopy'
| PROJECT host, user, new_file_extension, file_modification_rate, event_time

Hunt 03 · Non-browser process reading browser credential stores (last 60 days)

FROM edr_file_events
WHERE event_type = 'read'
  AND target_path MATCHES '.*/(Login Data|Cookies|Keychains/.+)$'
  AND reader_process NOT IN (browser_processes_allowlist)
  AND event_time >= NOW() - 60 DAYS
| JOIN edr_network_events ne
  ON ne.host = edr_file_events.host
  AND ne.event_time BETWEEN edr_file_events.event_time
                        AND edr_file_events.event_time + INTERVAL 5 MINUTE
| WHERE ne.request_method = 'POST'
  AND ne.request_body_size > 50000
| PROJECT host, user, reader_process, ne.destination_host, event_time

Hunt 04 · macOS LaunchAgent / Daemon plist writes by non-allowlisted signer (last 90 days)

FROM edr_file_events
WHERE endpoint_os = 'macos'
  AND target_filename MATCHES '.*/(LaunchAgents|LaunchDaemons)/.*\.plist$'
  AND writer_signer_category NOT IN ('os_vendor', 'allowlisted_mac_publisher')
  AND event_time >= NOW() - 90 DAYS
| PROJECT host, user, target_filename, writer_process, event_time

12 · Frequently asked questions