macOS Gatekeeper Bypass: xattr Quarantine Removal + chmod +x (FLATROOF/ROOFDECK)
Detects coordinated usage of 'xattr' to manipulate the com.apple.quarantine attribute and 'chmod' to grant executable permissions on sensitive macOS system or library paths. This behavior is indicative of an adversary attempting to bypass Gatekeeper or bypass execution restrictions on malicious payloads placed in system directories.
Microsoft Sentinel (KQL)
