A cb-response-surveyor (https://github.com/redcanaryco/cb-response-surveyor) definition file to look for Snake malware as seen in https://blog.fox-it.com/2017/05/03/snake-coming-soon-in-mac-os-x-flavour/.

snake.json

{
    "Snake Files": {
        "filemod": [".gdm-selinux",
                    ".gdm-socket",
                    ".ur-*",
                    "/Library/Scripts/queue",
                    "/Library/Scripts/installd.sh",
                    "/Library/LaunchDaemons/com.adobe.update.plist"]
    },
    "Snake Network": {
        "domain": ["car-service.effers.com"]
    },
    "Snake IP": {
        "ipaddr": ["83.229.87.11"]
    }
}