macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine

title: macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
id: 61dda346-943e-4274-95d3-f4f7ecf11a2a
status: test
description: This rule identifies macOS process executions of the xattr utility with parameters that delete the com.apple.quarantine extended attribute. Removing this attribute can be used to impair Gatekeeper protections by marking files as no longer quarantined. The detection relies on macOS process creation telemetry, matching the xattr binary path and command-line arguments including "-d" and "com.apple.quarantine".
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md
  - https://www.loobins.io/binaries/xattr/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2024-04-18
tags:
  - attack.defense-impairment
  - attack.t1553.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /xattr
    CommandLine|contains|all:
      - -d
      - com.apple.quarantine
  condition: selection
falsepositives:
  - Legitimate activities
level: low
license: DRL-1.1
related:
  - id: f5141b6d-9f42-41c6-a7bf-2a780678b29b
    type: derived