attack.t1553.001 | Detection.FYI

Gatekeeper Bypass via Xattr

Aug 12, 2024 · attack.defense-evasion attack.t1553.001 ·
Share on:

Detects macOS Gatekeeper bypass via xattr utility

Read More

Recent Posts

DNS Query To Remote Access Software Domain From Non-Browser App
Network Connection Initiated To BTunnels Domains
PwnKit Local Privilege Escalation
UNC2452 Process Creation Patterns
CVE-2021-1675 Print Spooler Exploitation Filename Pattern
HackTool - DInjector PowerShell Cradle Execution
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event
LPE InstallerFileTakeOver PoC CVE-2021-41379

Language

SIGMA 3883 ELASTIC 1182 MQL 430

Tags

ATTACK.DEFENSE-EVASION 1262 ATTACK.EXECUTION 826 USE-CASE-THREAT-DETECTION 809 DOMAIN-ENDPOINT 737 DATA-SOURCE-ELASTIC-DEFEND 581 ATTACK.PERSISTENCE 568 OS-WINDOWS 429 ATTACK.PRIVILEGE-ESCALATION 370 DETECTION.EMERGING-THREATS 330 DATA-SOURCE-ELASTIC-ENDGAME 319 ATTACK.CREDENTIAL-ACCESS 297 TACTIC-DEFENSE-EVASION 293 RESOURCES-INVESTIGATION-GUIDE 272 OS-LINUX 258