Monitor all macOS processes, command arguments, open files, sockets and perform real-time search. Call macOS shortcuts when the process starts or finishes.
anchor apple generic and identifier "com.itone.ProcessSpy" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = CU2ZY4UU43)