Gatekeeper is Apple's gate for first-run applications on macOS. MITRE ATT&CK tracks attempts to get around it as Gatekeeper Bypass, technique T1553.001. The tactic is defense impairment, and the platform is macOS.
How attackers use it
MITRE explains how Gatekeeper works so the gaps make sense. When a file is downloaded, the downloading application can set an extended attribute called com.apple.quarantine. For a first-run app carrying that flag, Gatekeeper checks the flag and prompts the user, checks system policy (App Store only, or App Store and identified developers), checks for a valid Apple Developer ID code signature, and checks the notarization ticket with Apple.
Adversaries can subvert one or more of those checks through logic errors, unchecked file types and external libraries. MITRE gives one concrete case: before macOS 13 Ventura, code signing and notarization checks only ran on first launch. That let adversaries write malicious executables into previously opened applications and skip the checks.
The quarantine flag is also opt-in. Files that arrive from a USB drive, optical disk, external hard drive, a drive shared over the local network, or the curl command may not get the flag at all. Drive-by Compromise is another way to avoid it.
How to detect it
MITRE lists no data sources here. Reasonable signals follow from the description: executables appearing inside apps that were already approved, binaries running without a quarantine attribute that you would expect to have one, and recent changes to the system security policy. Keep Macs on a current macOS release, since the first-launch gap above was closed in macOS 13.
How to reduce the risk
MITRE's mitigation is execution prevention. System settings can restrict macOS to applications from the App Store, which blocks much of this activity. If that is too strict, the identified developers setting is the middle ground. Enforce the setting with device management so users cannot relax it.
Quick check
Why might a file copied from a network share skip Gatekeeper prompts?
The quarantine flag is set by the application doing the download. Files from drives shared over the local network may not get it, so the first check never fires.
