MacOS Gatekeeper Bypass

name: MacOS Gatekeeper Bypass
id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects known MacOS security bypass techniques that may be used to enable malicious code execution.
    Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    
    from datamodel=Endpoint.Processes where
    
    (
        Processes.process = "*xattr*"
        Processes.process = "*com.apple.quarantine*"
    )
    OR
    (
        Processes.process = "*spctl*"
        Processes.process = "*master-disable*"
    )
    
    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_gatekeeper_bypass_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Administrators or power users may need to disable Gatekeeper to install unsigned tools.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://ss64.com/mac/xattr.html
    - https://ss64.com/mac/spctl.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$
        - field: dest
          type: system
          score: 20
          message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Privilege Escalation
    - MacOS Post-Exploitation
    - MacOS Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1553.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint