macOS Gatekeeper Bypass via Quarantine Flag Removal

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•9

This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from downloaded files. It specifically looks for HTTP responses containing the string 'com.apple.quarantine' in the file data, indicating a potential attempt to modify or remove this attribute during or after a download.