Detect Gatekeeper Bypass in Splunk
Adversaries bypass macOS Gatekeeper to execute untrusted applications without triggering security prompts. Gatekeeper enforces code signing and app notarization requirements. Bypass techniques include: removing the quarantine extended attribute (xattr -d com.apple.quarantine), using archive formats (.zip, .dmg, .iso) that strip quarantine on extraction, exploiting the first-launch trust mechanism, using DYLD_INSERT_LIBRARIES for code injection into trusted apps, and abusing symlinks to confuse Gatekeeper path checks. Malware widely abuses these techniques to run on macOS without triggering security warnings.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1553 Subvert Trust Controls
- Sub-technique
- T1553.001 Gatekeeper Bypass
- Canonical reference
- https://attack.mitre.org/techniques/T1553/001/
SPL Detection Query
index=mac_logs (sourcetype="macos:syslog" OR sourcetype="syslog" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval detection_type=case(
match(_raw, "(?i)(xattr.*-d.*com\.apple\.quarantine|xattr.*--delete.*quarantine)"),
"Quarantine_Attribute_Removed",
match(_raw, "(?i)spctl") AND
match(_raw, "(?i)(--add|--enable|--master-disable|--global-disable|assessments)"),
"Spctl_Gatekeeper_Modified",
match(_raw, "(?i)(DYLD_INSERT_LIBRARIES|DYLD_FRAMEWORK_PATH)"),
"DYLD_Injection_Detected",
match(_raw, "(?i)(QuarantineEventsV2|com\.apple\.LaunchServices.*Quarantine)") AND
NOT match(_raw, "(?i)(launchservicesd|quarantine|tccd)"),
"Quarantine_DB_Access",
true(), null()
)
| where isnotnull(detection_type)
| table _time, host, user, detection_type, _raw
| sort - _timeDetects Gatekeeper bypass techniques via macOS logs. xattr quarantine removal, spctl policy modification, DYLD injection, and quarantine database access by unauthorized processes are all covered. The xattr -d com.apple.quarantine pattern is the most common and highest-fidelity signal.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developer workstations removing quarantine from dev builds
- MDM-managed application deployment removing quarantine
- Enterprise IT operations bypassing Gatekeeper for authorized installs
Other platforms for T1553.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Remove Quarantine Attribute from a File
Expected signal: macOS Syslog/Unified Log: xattr command with -d com.apple.quarantine argument. Process creation for xattr binary.
- Test 2Check Gatekeeper Status
Expected signal: Process creation for spctl --status. macOS Unified Log entry for spctl execution.
- Test 3Disable and Re-enable Gatekeeper (Admin Required)
Expected signal: macOS Unified Log: spctl --master-disable event. Auth log: sudo authentication for spctl. Process creation for spctl.
Unlock Pro Content
Get the full detection package for T1553.001 including response playbook, investigation guide, and atomic red team tests.