spctl

The --master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.

sudo spctl --master-disable

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion

Detection

Elastic Detection Rules: Attempt to Disable Gatekeeper: github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml

Sigma Rules: Disable Security Tools: github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/spctl.yml

disable-gatekeeper.github.io/