Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
26
12
3
3
2
Contributors
11
7
5
4
4
Categories
36
23
22
5
4
Platforms
44
4
1
1
Products / Services
31
5
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects known MacOS security bypass techniques that may be used to enable malicious code execution.
Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
Detects coordinated usage of 'xattr' to manipulate the com.apple.quarantine attribute and 'chmod' to grant executable permissions on sensitive macOS system or library paths. This behavior is indicative of an adversary attempting to bypass Gatekeeper or bypass execution restrictions on malicious payloads placed in system directories.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects attempts to bypass macOS Gatekeeper security controls by manually removing the 'com.apple.quarantine' extended attribute using 'xattr' or by modifying executable permissions with 'chmod' on specific system or sensitive file paths, such as 'iSync'. These actions are commonly performed to evade execution restrictions on downloaded or untrusted files.
Detects a suspicious sequence of events where a user or process removes the 'com.apple.quarantine' extended attribute from a file bundle using 'xattr -cr', immediately followed by ad-hoc code signing the same file using 'codesign -s -'. This pattern is commonly used to bypass macOS Gatekeeper security controls by stripping quarantine flags and re-signing the application to allow execution of untrusted or modified code.
Detects the removal of the com.apple.quarantine extended attribute from a file followed by the execution of the macOS 'security' utility to dump or retrieve passwords from the Keychain within a 5-minute window. This sequence is indicative of an adversary attempting to bypass Gatekeeper-related restrictions on a potentially malicious tool, followed by unauthorized access to sensitive credentials stored in the Keychain.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects a sequence of actions often used to bypass macOS Gatekeeper protections: removing the quarantine extended attribute using 'xattr -c' on a file in the /tmp directory, followed by making that file executable with 'chmod +x', and finally executing the file. This behavior is indicative of malicious software attempting to evade Apple's security checks for downloaded files.
Detects attempts to bypass macOS Gatekeeper security controls by either removing the quarantine extended attribute or marking a file as executable using 'xattr' or 'chmod'. These techniques are used to allow untrusted or malicious applications to execute without user authorization.
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
Detects the use of the 'xattr' command to remove the 'com.apple.quarantine' extended attribute from a file. This attribute is used by macOS Gatekeeper to identify files downloaded from the internet and trigger security warnings. Removing it is a common technique to bypass Gatekeeper and execute untrusted software without user notification.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
Detects macOS persistence mechanism involving the registration of a disguised LaunchAgent via 'launchctl bootstrap', storing payloads in paths masquerading as system cache directories, and the subsequent removal of the 'com.apple.quarantine' extended attribute using 'xattr' to bypass Gatekeeper execution restrictions.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects attempts to bypass macOS Gatekeeper security controls by disabling security policies via the 'spctl' command, or by removing file quarantine attributes using the 'xattr' utility. These techniques are commonly used to execute unauthorized or malicious software that would otherwise be blocked by macOS security features.
This rule detects the use of the 'xattr' utility to remove the 'com.apple.quarantine' extended attribute from files located in '/tmp/'. Removing this attribute is a common technique used by attackers to bypass macOS Gatekeeper security controls, allowing unauthorized or malicious applications to execute without user prompts.
Detects the Gatekeeper-bypass sequence used by AmnesiaStealer's dropper: chmod +x, ad-hoc codesign (--sign -), and xattr -cr run together against a recently staged binary to defeat quarantine and code-signing checks before execution.
Page 1 of 3