Detect Gatekeeper Bypass in Google Chronicle

rule T1553_001_Gatekeeper_Bypass {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects macOS Gatekeeper bypass via xattr quarantine removal, spctl policy modification, DYLD library injection, or unauthorized quarantine database access"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1553.001"
    severity = "HIGH"
    confidence = "HIGH"
    platform = "macOS"

  events:
    (
      $proc.metadata.event_type = "PROCESS_LAUNCH"
      $proc.principal.platform = "MAC"
      (
        (
          re.regex($proc.target.process.file.full_path, `xattr$`) and
          (
            re.regex($proc.target.process.command_line, `-d com\.apple\.quarantine`) or
            re.regex($proc.target.process.command_line, `--delete com\.apple\.quarantine`) or
            re.regex($proc.target.process.command_line, `xattr -c `) or
            re.regex($proc.target.process.command_line, `xattr -(dr|r) `)
          )
        ) or
        (
          re.regex($proc.target.process.file.full_path, `spctl$`) and
          (
            re.regex($proc.target.process.command_line, `--add`) or
            re.regex($proc.target.process.command_line, `--enable`) or
            re.regex($proc.target.process.command_line, `--master-disable`) or
            re.regex($proc.target.process.command_line, `--global-disable`)
          )
        ) or
        (
          re.regex($proc.target.process.command_line, `DYLD_INSERT_LIBRARIES`) or
          re.regex($proc.target.process.command_line, `DYLD_FRAMEWORK_PATH`) or
          re.regex($proc.target.process.command_line, `DYLD_LIBRARY_PATH`)
        )
      )
    ) or
    (
      $file.metadata.event_type = "FILE_MODIFICATION"
      $file.principal.platform = "MAC"
      re.regex($file.target.file.full_path, `QuarantineEventsV2`)
      not re.regex($file.principal.process.file.full_path, `(launchservicesd|tccd|lsd)$`)
    )

  condition:
    $proc or $file
}