Detect Launch Agent in Splunk

index=osquery sourcetype=osquery_differential name=launchd
| where action="added"
| eval plist_path=coalesce('columns.path', spath(_raw, "columns.path"))
| eval agent_label=coalesce('columns.label', spath(_raw, "columns.label"), "unknown")
| eval program_args=coalesce('columns.program_arguments', 'columns.program', spath(_raw, "columns.program_arguments"), "unknown")
| eval run_at_load=coalesce('columns.run_at_load', "0")
| eval keep_alive=coalesce('columns.keep_alive', "0")
| eval on_demand=coalesce('columns.on_demand', "0")
| where match(plist_path, "(?i)/Library/LaunchAgents/")
| eval AgentScope=case(
    match(plist_path, "(?i)^/System/Library/LaunchAgents/"), "System",
    match(plist_path, "(?i)^/Library/LaunchAgents/"), "Global",
    1=1, "User"
)
| eval SuspiciousProgram=if(
    match(program_args, "(?i)(\\bbash\\b|\\bsh\\b|\\bzsh\\b|python3?|\\bruby\\b|\\bperl\\b|\\bcurl\\b|\\bwget\\b|osascript|\\bnode\\b|/tmp/|/var/tmp/|/var/folders/)"),
    1, 0
)
| eval AppleNameSpoof=if(
    match(plist_path, "com\.apple\.[a-z]+\.[a-z]+\.plist") AND NOT match(plist_path, "(?i)^/System/Library/"),
    1, 0
)
| eval RandomName=if(
    match(plist_path, "com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist") AND NOT match(plist_path, "(com\.apple\.|com\.microsoft\.|com\.adobe\.|com\.google\.)"),
    1, 0
)
| eval PersistenceEnabled=if(run_at_load="1" OR keep_alive="1", 1, 0)
| eval RiskScore=SuspiciousProgram + AppleNameSpoof + RandomName + PersistenceEnabled
| where RiskScore > 0
| table _time, host, plist_path, agent_label, program_args, AgentScope, run_at_load, keep_alive, SuspiciousProgram, AppleNameSpoof, RandomName, PersistenceEnabled, RiskScore
| sort - RiskScore, - _time