macOS Ad-hoc Codesign and Quarantine Removal Following Network-Delivered File (Screen Sharing/Download Correlated)

Duo Tech@duotech

•updated Aug 17, 2026•0•0•10

Detects ad-hoc code-signing or quarantine-attribute removal on a binary delivered via the Screen Sharing file-copy channel or another network delivery within the preceding 30 minutes, indicating Gatekeeper-bypass preparation of a downloaded exploit tool.