Cuckoo StealerS1153 ↗
Can use xattr -d com.apple.quarantine to remove the quarantine flag attribute.12
tfMITRE ATT&CK sub-technique
Gatekeeper Bypass T1553.001
sub-technique of T1553 Subvert Trust Controls
- Tactic
- Defense Impairment
- Platform
- macOS
- Version
- 2.0
- Created
- 05 February 2020
- Last modified
- 12 May 2026
- Contributors
- Brandon Dalton @PartyD0lphin; Swasti Bhushan Deb, IBM India Pvt. Ltd.
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.6
Tools & malware68th pct
Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Gatekeeper Bypass MITRE reference T1553.001
68th pctamong all ATT&CK techniques for number of tools
6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MacMaS1016 ↗
Has removed the com.apple.quarantineattribute from the dropped file, $TMPDIR/airportpaird.1
XCSSETS0658 ↗
Has dropped a malicious applet into an app's .../Contents/MacOS/ folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).1
OSX/ShlayerS0402 ↗
If running with elevated privileges, OSX/Shlayer has used the spctl command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.123
CoinTickerS0369 ↗
Downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.1
OSX_OCEANLOTUS.DS0352 ↗
Uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper.12
All 6 software entries for this technique
Offense vs defense T1553.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2020 Q4Gatekeeper Bypass detection strategy DET0288
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Gatekeeper Bypass via Quarantine Flag and Trust Control Manipulation
1 platform
AN0800 · macOS
Correlates suspicious removal or modification of the com.apple.quarantine extended attribute, manipulation of LSFileQuarantineEnabled values in Info.plist, and unexpected process execution of unsigned or non-notarized binaries. Also monitors abnormal trust validation failures in unified logs and unusual activity in QuarantineEvents database entries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Trust validation failures or bypass attempts during notarization and code signing checks |
| File MetadataDC0059 | macos:unifiedlog | xattr -d com.apple.quarantine or similar attribute removal commands |
| File ModificationDC0061 | macos:osquery | Changes to LSFileQuarantineEnabled field in Info.plist |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| QuarantineBypassAllowList | Legitimate enterprise update tools or deployment frameworks that may strip quarantine flags |
| CertificateAuthorityList | Baseline trusted Apple Developer IDs and enterprise certs used for code signing |
| TimeWindow | Time correlation window for xattr modification followed by suspicious process execution |
Execution PreventionM1038
System settings can prevent applications from running that haven't been downloaded through the Apple Store which can help mitigate some of these issues.
Tests1Executorssh 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformsmacos
Tests from Atomic Red Team (MIT licence) · technique definition