Techniques › T1553 › AN1248
AN1248 Analytic 1248
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection monitors modification of code signing attributes, Gatekeeper/quarantine flags, and insertion of new trust certificates via security add-trusted-cert. Identifies adversary use of xattr to strip quarantine flags from downloaded binaries. Correlates with abnormal module loads bypassing SIP protections.</p>
- Detects
- T1553 Subvert Trust Controls
- Part of
- DET0452 Detect Subversion of Trust Controls via Certificate, Registry, and Attribute Manipulation
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | New certificate trust settings added by unexpected process | DC0059 File Metadata |
| macos:unifiedlog | xattr -d com.apple.quarantine or similar removal commands | DC0064 Command Execution |
| macos:osquery | Unsigned or ad-hoc signed process executions in user contexts | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
QuarantineBypassAllowList | List of enterprise apps where quarantine flag removal is expected |
CertificateAuthorityList | Baseline trusted root and intermediate CAs for comparison |