T1553.001Defense Impairment
Gatekeeper Bypass
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports1
Detections
1 Sigma rule tagged T1553.001Gatekeeper BypassT1553.0011 general rule
- Gatekeeper Bypass via Xattrlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Gatekeeper Bypass
1 CVE, by priority. Each link shows its badge.- CVE-2021-30657Apple macOS Unspecified VulnerabilityAI mapping from the description · primary impact68.5%Top 0.66%70.6priority