{"id":"f5141b6d-9f42-41c6-a7bf-2a780678b29b","title":"Gatekeeper Bypass via Xattr","description":"Detects macOS Gatekeeper bypass via xattr utility","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2020-10-19","modified":"2024-04-18","tags":["attack.defense-impairment","attack.t1553.001"],"technique_ids":["T1553.001"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Legitimate activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md","https://www.loobins.io/binaries/xattr/"],"source_path":"rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml","source_sha256":"d23c6b4a3a3271d993bb851049f35c7946408445a9dcf914367856cd8ea6cd9c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Gatekeeper Bypass via Xattr\nid: f5141b6d-9f42-41c6-a7bf-2a780678b29b\nstatus: test\ndescription: Detects macOS Gatekeeper bypass via xattr utility\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md\n    - https://www.loobins.io/binaries/xattr/\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2024-04-18\ntags:\n    - attack.defense-impairment\n    - attack.t1553.001\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/xattr'\n        CommandLine|contains|all:\n            - '-d'\n            - 'com.apple.quarantine'\n    condition: selection\nfalsepositives:\n    - Legitimate activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1553.001","id":"T1553.001","name":"Gatekeeper Bypass","page":"techniques/enterprise/T1553.001/"}],"data_path":"data/detection-rules/f5141b6d-9f42-41c6-a7bf-2a780678b29b.json","kind":"sigma"}