9 lines
388 B
Markdown
9 lines
388 B
Markdown
- Check for quarantine attribute (`com.apple.quarantine`), which triggers Gatekeeper upon execution:
|
|
- `xattr -l <executable_file>`
|
|
- XProtect's Yara rules can be inspected:
|
|
- `locate XProtect.yara`
|
|
- Generally useless in default settings
|
|
- XProtect requires three conditions to even scan a file:
|
|
- Being run for the first time
|
|
- File hash has changed
|
|
- Yara rules have been updated |