T1553.001No distinct observable

Gatekeeper Bypass

Defense ImpairmentmacOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

DET0288's single analytic, AN0800, offers exactly three log sources -- macos:unifiedlog (xattr/quarantine-flag removal), macos:unifiedlog (trust-validation failures during notarization/code-signing), and macos:osquery (LSFileQuarantineEnabled in Info.plist) -- and none of the three has a field vocabulary this corpus has ever written against. No rule anywhere in data/detections selects on macos/unifiedlog or macos/osquery fields; every prior brief offering only those two sources has declined rather than guess field names, which AUTHORING.md rule 2 forbids outright. […]

What the technique is

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications. Based on an opt-in system, when files are downloaded an extended attribute (xattr) called com.apple.quarantine (also known as a quarantine flag) can be set on the file by the application performing the download. Launch Services opens the application in a suspended state. For first run applications with the quarantine flag set, Gatekeeper executes the following functions: 1. Checks extended attribute – Gatekeeper checks for the quarantine flag, then provides an alert prompt to the user to allow or deny execution. 2. Checks System Policies - Gatekeeper checks the system security policy, allowing execution of apps downloaded from either just the App Store or the App Store and identified developers. 3. Code Signing – Gatekeeper checks for a valid code signature from an Apple Developer ID. 4. […]

Read it on attack.mitre.org

What MITRE says you would watch

AN0800
Correlates suspicious removal or modification of the com.apple.quarantine extended attribute, manipulation of LSFileQuarantineEnabled values in Info.plist, and unexpected process execution of unsigned or non-notarized binaries. Also monitors abnormal trust validation failures in unified logs and unusual activity in QuarantineEvents database entries.