Gatekeeper disabled
highmacOSSingle eventstablemacos.defense_evasion.gatekeeper_disabled · v1.0.0
What it detects
Gatekeeper disabled via spctl (--master-disable / --global-disable), removing macOS code-signing enforcement so unsigned/quarantined apps run without prompt.
MITRE ATT&CK mapping
- T1562.001Impair Defenses: Disable or Modify Tools· Defense Evasion
False positives and triage
Rarely legitimate on managed endpoints. Some developer machines disable Gatekeeper deliberately — confirm with the user and re-enable.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/macos/gatekeeper_disabled.yaml, licensed under the Apache License 2.0.
id: macos.defense_evasion.gatekeeper_disabled
version: 1.0.0
status: stable
severity: high
confidence: 0.85
platforms: [macos]
mitre_techniques: [T1562.001]
description: |
Gatekeeper disabled via spctl (--master-disable / --global-disable), removing
macOS code-signing enforcement so unsigned/quarantined apps run without prompt.
match:
raw_message_regex: '(?i)spctl\b.*--(master|global)-disable'
false_positive_guidance: |
Rarely legitimate on managed endpoints. Some developer machines disable
Gatekeeper deliberately — confirm with the user and re-enable.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.