Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.
spctlspctlSandbox: execFile · Timeout: 30s
security.defenseevasion.bypass Disable Gatekeeper: The --master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.
sudo spctl --master-disable| Type | Rule / Indicator |
|---|---|
| elastic | https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml Elastic Detection Rules: Attempt to Disable Gatekeeper |
| sigma | https://github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml Sigma Rules: Disable Security Tools |
Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.