388 B
388 B
- Check for quarantine attribute (
com.apple.quarantine), which triggers Gatekeeper upon execution:xattr -l <executable_file>
- XProtect's Yara rules can be inspected:
locate XProtect.yara- Generally useless in default settings
- XProtect requires three conditions to even scan a file:
- Being run for the first time
- File hash has changed
- Yara rules have been updated