Detect Gatekeeper Bypass in Microsoft Sentinel
Adversaries bypass macOS Gatekeeper to execute untrusted applications without triggering security prompts. Gatekeeper enforces code signing and app notarization requirements. Bypass techniques include: removing the quarantine extended attribute (xattr -d com.apple.quarantine), using archive formats (.zip, .dmg, .iso) that strip quarantine on extraction, exploiting the first-launch trust mechanism, using DYLD_INSERT_LIBRARIES for code injection into trusted apps, and abusing symlinks to confuse Gatekeeper path checks. Malware widely abuses these techniques to run on macOS without triggering security warnings.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1553 Subvert Trust Controls
- Sub-technique
- T1553.001 Gatekeeper Bypass
- Canonical reference
- https://attack.mitre.org/techniques/T1553/001/
KQL Detection Query
// T1553.001 — Gatekeeper Bypass detection (macOS)
// Part 1: Detect xattr removal of quarantine attribute
let QuarantineRemoval = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "xattr"
| where ProcessCommandLine has_any ("-d com.apple.quarantine", "--delete com.apple.quarantine",
"-c ", "-r ", "-dr")
| extend DetectionType = "Quarantine_Attribute_Removed"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 2: Detect spctl operations to add trusted sources or modify policy
let SpctlBypass = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "spctl"
| where ProcessCommandLine has_any ("--add", "--enable", "--master-disable",
"--global-disable", "assessments")
| extend DetectionType = "Spctl_Gatekeeper_Modified"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, DetectionType;
// Part 3: Detect DYLD injection into Gatekeeper-trusted processes
let DYLDInject = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("DYLD_INSERT_LIBRARIES", "DYLD_FRAMEWORK_PATH",
"DYLD_LIBRARY_PATH")
| extend DetectionType = "DYLD_Injection"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, DetectionType;
// Part 4: Detect writes to quarantine database removal
let QuarantineDB = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "QuarantineEventsV2" or
FolderPath has "com.apple.LaunchServices"
| where ActionType in ("FileModified", "FileDeleted")
| where InitiatingProcessFileName !in~ ("quarantine", "tccd", "launchservicesd")
| extend DetectionType = "Quarantine_Database_Modified"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
InitiatingProcessFileName, DetectionType;
union QuarantineRemoval, SpctlBypass, DYLDInject, QuarantineDB
| sort by Timestamp descFour-part Gatekeeper bypass detection. Part 1 detects xattr commands removing the quarantine attribute (com.apple.quarantine) which is the most direct Gatekeeper bypass. Part 2 catches spctl commands modifying Gatekeeper policy or trust settings. Part 3 identifies DYLD environment variable injection which can bypass Gatekeeper by injecting into already-trusted processes. Part 4 monitors the quarantine events database for unauthorized modifications.
Data Sources
Required Tables
False Positives & Tuning
- Developers removing quarantine from their own development builds for testing
- Enterprise IT deploying applications via MDM or managed distribution where quarantine removal is part of the deployment process
- Software build systems removing quarantine from build artifacts before packaging
- System administrators disabling Gatekeeper temporarily for authorized software installation
Other platforms for T1553.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Remove Quarantine Attribute from a File
Expected signal: macOS Syslog/Unified Log: xattr command with -d com.apple.quarantine argument. Process creation for xattr binary.
- Test 2Check Gatekeeper Status
Expected signal: Process creation for spctl --status. macOS Unified Log entry for spctl execution.
- Test 3Disable and Re-enable Gatekeeper (Admin Required)
Expected signal: macOS Unified Log: spctl --master-disable event. Auth log: sudo authentication for spctl. Process creation for spctl.
Unlock Pro Content
Get the full detection package for T1553.001 including response playbook, investigation guide, and atomic red team tests.