Gatekeeper Bypass via Xattr (f5141b6d-9f42-41c6-a7bf-2a780678b29b)

Detects macOS Gatekeeper bypass via xattr utility

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Gatekeeper Bypass - T1553.001 (31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e)	Attack Pattern	Gatekeeper Bypass via Xattr (f5141b6d-9f42-41c6-a7bf-2a780678b29b)	Sigma-Rules	1
Gatekeeper Bypass - T1553.001 (31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e)	Attack Pattern	Subvert Trust Controls - T1553 (b83e166d-13d7-4b52-8677-dff90c548fd7)	Attack Pattern	2