Detecting and Mitigating the GateKeeper User Override on macOS in an Enterprise Environment

For red teamers, social engineering a macOS user into executing an application is a common way to gain code execution on a remote macOS client machine. Apple's development of their macOS built-in security mechanism, GateKeeper, has made this a more difficult task, but not impossible. It is effortless for a macOS user to bypass GateKeeper by simply right-clicking to execute a potentially malicious application. An adversary can convince the user to override GateKeeper in this manner and gain remote code execution on the user's system. In fact, many adversaries have done just that.This could lead to further exploitation of a corporate network, so quickly detecting this user activity is essential. While this is a crucial detection, endpoint security products seem to lack the capability. This research explores the detection possibilities for the GateKeeper user override.Developing a GateKeeper detection will allow corporate security teams to protect their environments from users being socially engineered into executing malware.This is an essential step in increasing the defenses of our macOS corporate environments.