{"id":"T1553.001","name":"Gatekeeper Bypass","url":"https://attack.mitre.org/techniques/T1553/001","tactics":["defense-impairment"],"platforms":["macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0288","stix_id":"x-mitre-detection-strategy--62d7a748-dee5-46c7-b61c-77f57f371b4f","name":"Detect Gatekeeper Bypass via Quarantine Flag and Trust Control Manipulation","url":"https://attack.mitre.org/detectionstrategies/DET0288","analytics":[{"id":"AN0800","stix_id":"x-mitre-analytic--b6516e8b-fd18-4c92-8701-1762d8321168","name":"Analytic 0800","description":"Correlates suspicious removal or modification of the com.apple.quarantine extended attribute, manipulation of LSFileQuarantineEnabled values in Info.plist, and unexpected process execution of unsigned or non-notarized binaries. Also monitors abnormal trust validation failures in unified logs and unusual activity in QuarantineEvents database entries.","url":"https://attack.mitre.org/detectionstrategies/DET0288#AN0800","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"xattr -d com.apple.quarantine or similar attribute removal commands","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Trust validation failures or bypass attempts during notarization and code signing checks","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"Changes to LSFileQuarantineEnabled field in Info.plist","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"QuarantineBypassAllowList","description":"Legitimate enterprise update tools or deployment frameworks that may strip quarantine flags"},{"field":"CertificateAuthorityList","description":"Baseline trusted Apple Developer IDs and enterprise certs used for code signing"},{"field":"TimeWindow","description":"Time correlation window for xattr modification followed by suspicious process execution"}],"live":true,"detection_strategies":["DET0288"],"techniques":["T1553.001"]}],"live":true,"version":"1.0","techniques":["T1553.001"]}],"sigma_rules":[{"id":"f5141b6d-9f42-41c6-a7bf-2a780678b29b","title":"Gatekeeper Bypass via Xattr","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2020-10-19","modified":"2024-04-18","description":"Detects macOS Gatekeeper bypass via xattr utility","references":["https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md","https://www.loobins.io/binaries/xattr/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1553.001"],"path":"rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml","techniques":["T1553.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}