Detection rules › Sigma
macOS Gatekeeper User Override
Detects Gatekeeper user override events where users explicitly allow execution of unsigned or unnotarized applications. While sometimes legitimate, this can indicate social engineering attacks or user attempts to bypass security controls. Available on macOS 15+.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1204 User Execution |
| Defense Impairment | T1553.001 Subvert Trust Controls: Gatekeeper Bypass |
Rule body yaml
title: macOS Gatekeeper User Override
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: 'Detects Gatekeeper user override events where users explicitly allow
execution
of unsigned or unnotarized applications. While sometimes legitimate, this can
indicate social engineering attacks or user attempts to bypass security controls.
Available on macOS 15+.
'
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1553/001/
- https://attack.mitre.org/techniques/T1204/
logsource:
product: macos
service: endpointsecurity
detection:
selection:
esf.event_type: 146
event.action: gatekeeper_user_override
condition: selection
falsepositives:
- Users intentionally running trusted unsigned software
- Development and testing activities
- Legacy applications without notarization
fields:
- event_type
- event_name
- User
- file_path
- application
tags:
- attack.defense_evasion
- attack.t1553.001
- attack.execution
- attack.t1204
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type: 146
event.action: gatekeeper_user_override
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
esf.event_type | eq |
|
event.action | eq |
|