Gatekeeper Bypass
Subtechnique · ATTACK:enterprise:T1553.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1553.001",
"title": "Gatekeeper Bypass",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1553/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e",
"external_id": "T1553.001",
"domain": "enterprise",
"created": "2020-02-05T16:16:08.471Z",
"modified": "2026-05-12T15:12:00.624Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"defense-impairment"
],
"source_references": [
{
"source_name": "Application Bundle Manipulation Brandon Dalton",
"url": "https://redcanary.com/blog/mac-application-bundles/"
},
{
"source_name": "theevilbit gatekeeper bypass 2021",
"url": "https://theevilbit.github.io/posts/gatekeeper_not_a_bypass/"
},
{
"source_name": "OceanLotus for OS X",
"url": "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
},
{
"source_name": "TheEclecticLightCompany Quarantine and the flag",
"url": "https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/"
},
{
"source_name": "TheEclecticLightCompany apple notarization ",
"url": "https://eclecticlight.co/2020/08/28/how-notarization-works/"
},
{
"source_name": "20 macOS Common Tools and Techniques",
"url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a72e519-b85c-4dec-9ffd-74eec8af03ca
Application Bundle Manipulation Brandon DaltonATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60a6f8ce-1ee6-4770-8d83-9c2717d53fc3
Carbon Black Shlayer Feb 2019 · Shlayer jamf gatekeeper bypass 2021 · objectivesee osx.shlayer apple approved 2020ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--819bc603-b0fe-4681-a235-3c6e9a36e3b5
ATTACK:enterprise:T1553.001 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2e18006-9caf-494c-9d41-4a4ef5b3bf78
ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8420a85-8724-450c-858e-217cdab58df8
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc8fa1fa-6aff-45f7-a425-2f62bf729324
ESET DazzleSpy Jan 2022ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e735944e-9387-4cfb-bf2c-0a1c27d93bce
Trend Micro MacOS Backdoor November 2020 · 20 macOS Common Tools and TechniquesATTACK:enterprise:S0369 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4eabef1-c66d-45b2-a7c7-6c4cefe4862b
CoinTicker 2019