Quarantine removed
mediummacOSSingle eventstablemacos.defense_evasion.quarantine_removed · v1.0.0
What it detects
The com.apple.quarantine extended attribute removed via xattr, stripping the macOS download provenance flag so Gatekeeper stops vetting a downloaded file.
MITRE ATT&CK mapping
- T1553.001Subvert Trust Controls: Gatekeeper Bypass· Defense Evasion
False positives and triage
Developers sometimes clear quarantine to run their own builds. Judge by the target path and whether the file was recently downloaded from the internet.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/macos/quarantine_removed.yaml, licensed under the Apache License 2.0.
id: macos.defense_evasion.quarantine_removed
version: 1.0.0
status: stable
severity: medium
confidence: 0.7
platforms: [macos]
mitre_techniques: [T1553.001]
description: |
The com.apple.quarantine extended attribute removed via xattr, stripping the
macOS download provenance flag so Gatekeeper stops vetting a downloaded file.
match:
raw_message_regex: '(?i)xattr\b.*(-d|--delete|-c|-r).*com\.apple\.quarantine|xattr\b.*com\.apple\.quarantine'
false_positive_guidance: |
Developers sometimes clear quarantine to run their own builds. Judge by the
target path and whether the file was recently downloaded from the internet.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.