CmdID / Techniques / T1553
T1553.001 Subvert Trust Controls: Gatekeeper Bypass
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. MITRE ATT&CK
1 Sigma rule
T1553.001 on attack.mitre.org
Part of
MITRE ATT&CK
T1553Subvert Trust Controls
Sigma rules tagged with it
process creation, the highest levels first
Command lines CmdID reads as it
everyday examples from tldr-pages, CC BY 4.0
Delete an attribute from a given file on the page for xattr
xattr -d com.apple.quarantine fileIdentifyAn example is here when CmdID’s reading of it names T1553.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.