spctl #

Created by Brendan Chamberlain (@infosecB)

Description ##

A full length description of the binary goes here.

Paths ##

• /usr/sbin/spctl

Use Cases ##

Disable Gatekeeper ##

The –master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.

sudo spctl --master-disable

Detections ##

• Elastic Detection Rules: Attempt to Disable Gatekeeper

• Sigma Rules: Disable Security Tools

Resources ##

• Disable Gatekeeper on macOS Big Sur (11.x)