first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,9 @@
+- Check for quarantine attribute (`com.apple.quarantine`), which triggers Gatekeeper upon execution:
+	- `xattr -l <executable_file>`
+- XProtect's Yara rules can be inspected:
+	- `locate XProtect.yara`
+	- Generally useless in default settings
+- XProtect requires three conditions to even scan a file:
+	- Being run for the first time
+	- File hash has changed
+	- Yara rules have been updated