detection.wiki

Detection rules › Sigma

macOS ULS Gatekeeper Block (spctl)

Status
experimental
Severity
high
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detect Gatekeeper blocks logged by spctl or related subsystems.

Known false positives

  • unsigned internal tools during development

Rule body

title: macOS ULS Gatekeeper Block (spctl)
id: 2f1b3c4d-5e6f-4a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detect Gatekeeper blocks logged by spctl or related subsystems.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: unifiedlog
level: high
detection:
  selection:
    subsystem: com.apple.security.assessment
    message|contains:
    - rejected
    - assessment failed
  condition: selection
falsepositives:
- unsigned internal tools during development
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  subsystem: com.apple.security.assessment
  message|contains:
  - rejected
  - assessment failed

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
messagematch
  • assessment failed
  • rejected
field:"message" kind:match
subsystemeq
  • com.apple.security.assessment
field:"subsystem" kind:eq value:"com.apple.security.assessment"