Elastic medium stable eql

Attempt to Disable Gatekeeper

Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and
 process.name == "spctl" and
 process.args like~ "--master-disable"

Field Validations

Loading…

Comments (0)

Loading comments...