# spctl

> Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.

Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.

- Page: https://loobins.io/binaries/spctl/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-23
- Tactics: Defense Evasion

## Paths

- `/usr/sbin/spctl`

## Example Use Cases

### Disable Gatekeeper

The --master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.

```bash
sudo spctl --master-disable
```

- Tactics: Defense Evasion
- Tags: gatekeeper

## Detections

- [Elastic Detection Rules: Attempt to Disable Gatekeeper](https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml)
- [Sigma Rules: Disable Security Tools](https://github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml)

## Resources

- [Disable Gatekeeper on macOS Big Sur (11.x)](https://disable-gatekeeper.github.io/)