Detectionlowtest

Gatekeeper Bypass via Xattr

Detects macOS Gatekeeper bypass via xattr utility

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Daniil Yugoslavskiy, oscd.communityCreated Mon Oct 19Updated Thu Apr 18f5141b6d-9f42-41c6-a7bf-2a780678b29bmacos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/xattr'
        CommandLine|contains|all:
            - '-d'
            - 'com.apple.quarantine'
    condition: selection

False Positives

Legitimate activities

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1553.001 · Gatekeeper Bypass

Rule Metadata

Rule ID

f5141b6d-9f42-41c6-a7bf-2a780678b29b

Status

test

Level

low

Type

Detection

Created

Mon Oct 19

Modified

Thu Apr 18

Author

Daniil Yugoslavskiy, oscd.community

Path

rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml

Raw Tags

attack.defense-evasionattack.t1553.001

View on GitHub