Gatekeeper Bypass via Xattr Utility

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•39

This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from a file using the 'xattr' utility. This action prevents Gatekeeper from performing its security checks on the file, allowing untrusted applications to execute without user prompts.