macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
Flags macOS xattr usage that deletes the com.apple.quarantine extended attribute, consistent with a Gatekeeper bypass attempt.
- Product
- macos
- Category
- process_creation
- Author
- Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-19
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS process executions where the binary name ends with /xattr and the command line includes both -d and com.apple.quarantine, indicating removal of the quarantine attribute. Attackers can use this to reduce Gatekeeper protections on downloaded files. Detection relies on process creation telemetry with executable path and full command-line content.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md
- loobins.iohttps://www.loobins.io/binaries/xattr/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
id: 61dda346-943e-4274-95d3-f4f7ecf11a2a
status: test
description: This rule flags macOS process executions where the binary name ends with /xattr and the command line includes both -d and com.apple.quarantine, indicating removal of the quarantine attribute. Attackers can use this to reduce Gatekeeper protections on downloaded files. Detection relies on process creation telemetry with executable path and full command-line content.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md
- https://www.loobins.io/binaries/xattr/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2024-04-18
tags:
- attack.defense-impairment
- attack.t1553.001
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /xattr
CommandLine|contains|all:
- -d
- com.apple.quarantine
condition: selection
falsepositives:
- Legitimate activities
level: low
license: DRL-1.1
related:
- id: f5141b6d-9f42-41c6-a7bf-2a780678b29b
type: derived