Related to this, we created a (very) simple Extension Attribute to flag machines that *might* be infected with the latest strain.
We then created a group that keys on machines that reply with 'Alert'. That group is set to email upon any change.
I'm sure there are more effective ways of doing this but it's better than nothing.
---------
#!/bin/bash
if [ -e /Users/Shared/.*.so ]; then
echo "<result>Alert</result>";
else
echo "<result>Clean</result>";
fi
