Quarantine attribute stripped via xattr -cr to bypass Gatekeeper

Duo Tech@duotech

•updated Jul 14, 2026•1•0•3

Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.