Bypass Gatekeeper via xattr
ExecutionDefense EvasionmacOS
Use xattr to remove quarantine extended attribute from a file.
xattr -d com.apple.quarantine FILE- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
- Native
- Execution, Defense Evasion
- Detection
- Gatekeeper Bypass via Xattr: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.ymlJamf Protect: Detect activity related to xattr and extended attributes: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/xattr_extended_attributes_activity