- Check for quarantine attribute (`com.apple.quarantine`), which triggers Gatekeeper upon execution:
	- `xattr -l <executable_file>`
- XProtect's Yara rules can be inspected:
	- `locate XProtect.yara`
	- Generally useless in default settings
- XProtect requires three conditions to even scan a file:
	- Being run for the first time
	- File hash has changed
	- Yara rules have been updated