ATT&CK ReferencesShlayer jamf gatekeeper bypass 2021

Shlayer jamf gatekeeper bypass 2021

Jaron Bradley. (2021, April 26). Shlayer malware abusing Gatekeeper bypass on macOS. Retrieved September 22, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1222.002 Linux and Mac Permissions	MalwareOSX/Shlayer	OSX/Shlayer can use the `chmod` utility to set a file as executable, such as `chmod 777` or `chmod +x`. 20 macOS Common Tools and Techniques Carbon Black Shlayer Feb 2019 Shlayer jamf gatekeeper bypass 2021
T1553.001 Gatekeeper Bypass	MalwareOSX/Shlayer	If running with elevated privileges, OSX/Shlayer has used the `spctl` command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks. Carbon Black Shlayer Feb 2019 Shlayer jamf gatekeeper bypass 2021 objectivesee osx.shlayer apple approved 2020
T1564 Hide Artifacts	MalwareOSX/Shlayer	OSX/Shlayer has used the `mktemp` utility to make random and unique filenames for payloads, such as `export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"` or `mktemp -t Installer`. 20 macOS Common Tools and Techniques Shlayer jamf gatekeeper bypass 2021 sentinelone shlayer to zshlayer
T1564.011 Ignore Process Interrupts	MalwareOSX/Shlayer	OSX/Shlayer has used the `nohup` command to instruct executed payloads to ignore hangup signals. Shlayer jamf gatekeeper bypass 2021

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.