CmdID

CmdID / Commands

spctl

Manage the security assessment policy subsystem. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Manage the security assessment policy subsystem. Utility for managing Gatekeeper in macOS.

Turn off Gatekeeper

spctl --master-disableIdentify

Add a rule to allow an application to run (labeling of rule is optional)

spctl --add --label rule_name path/to/fileIdentify

Turn on Gatekeeper

spctl --master-enableIdentify

List all rules on the system

spctl --listIdentify

What detects it

Sigma process creation rules that name spctl
mediumDisable Security ToolsDaniil Yugoslavskiy, oscd.community