T1553.001 — Gatekeeper Bypass

Tactic: Defense Impairment · Platforms: macOS

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top…

Sub-technique of Subvert Trust Controls (T1553).

Sigma detection rules (1)

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

title: "T1553.001 Subvert Trust Controls: Gatekeeper Bypass"
id: f5d15193-8ff0-4f3a-9487-20e81722fc93
description: 'Detect Gatekeeper Bypass via Quarantine Flag and Trust Control Manipulation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: QuarantineBypassAllowList, CertificateAuthorityList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1553/001
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/spctl'
      - '/xattr'
  selection_args:
    CommandLine|contains:
      - '--master-disable'
      - '--global-disable'
      - '-d com.apple.quarantine'
  condition: selection and selection_args

falsepositives:
  - Developers commonly disable Gatekeeper or strip the quarantine attribute on their own unsigned test builds during local development, so this should be scoped to targets outside a recognized developer working directory.

level: high

Related sub-techniques

Explore