YARA-X rule for recent LightSpy variant from https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos

macho_libframework_suspicious.yara

import "macho"

rule macho_libframework_suspicious {
  meta:
    description = "Detects on LightSpy variant dylibs"
    author = "Jacob Latonis @jacoblatonis"
    date = "2024-04-25"

  condition:
    macho.has_dylib("/usr/lib/libsqlite3.dylib") and macho.has_dylib("/usr/local/lib/libframework.dylib")
}