MAC-GATEKEEPER-BYPASSDefense Evasion

Gatekeeper / Quarantine Bypass

Strip com.apple.quarantine xattr / use unsigned helper binaries / abuse SwiftSyntax-style trust gaps to run unsigned code without prompt.

§ Where this technique fits

MAC-GATEKEEPER-BYPASS is catalogued under the Defense Evasion tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Gatekeeper bypass → unsigned binary execution
Deliver a payload that strips the com.apple.quarantine xattr (via .dmg with no quarantine attribute or an archive format that doesn't preserve xattrs) — Gatekeeper never prompts.
step 2 / 5

§ What commonly comes next

01
Phishing
T1566 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Gatekeeper bypass → unsigned binary execution

§ What commonly comes next