huntrule

macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine

Flags macOS xattr usage that deletes the com.apple.quarantine extended attribute, consistent with a Gatekeeper bypass attempt.

FreeReviewedSigma · Low · v2
Product
macos
Category
process_creation
Author
Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags macOS process executions where the binary name ends with /xattr and the command line includes both -d and com.apple.quarantine, indicating removal of the quarantine attribute. Attackers can use this to reduce Gatekeeper protections on downloaded files. Detection relies on process creation telemetry with executable path and full command-line content.

Reporting behind it

Related detections6 linkedT1553.001 — drag to rearrange
Suspicious Removal of the macOS Quarantine Attribute via Xattr (via process_creation)
Untrusted Disabling of macOS Gatekeeper via Spctl (via process_creation)
Suspicious Interpreter Spawned by launchd from Application Bundle
Suspicious Gatekeeper Quarantine Database Query via sqlite3
Suspicious File Download to tmp and Quarantine Removal via curl and xattr
Suspicious macOS Quarantine Attribute Removal via xattr (via process_creation)
macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
Pivot detection · T1553.001 · 6 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.