spctl #

Created by Brendan Chamberlain (@infosecB)

Description ##

Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.

Paths ##

• /usr/sbin/spctl

Use Cases ##

Disable Gatekeeper ##

The –master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.

sudo spctl --master-disable

Detections ##

• Elastic Detection Rules: Attempt to Disable Gatekeeper

• Sigma Rules: Disable Security Tools

Resources ##

• Disable Gatekeeper on macOS Big Sur (11.x)