05 · Execution & Persistence
Quarantine Events and Gatekeeper: Tracing Mac Downloads
Decode the com.apple.quarantine xattr, query QuarantineEventsV2, and use spctl, codesign and unified logs to trace downloads and Gatekeeper decisions.
Read guide
05 · Execution & Persistence
Decode the com.apple.quarantine xattr, query QuarantineEventsV2, and use spctl, codesign and unified logs to trace downloads and Gatekeeper decisions.