attack_technique: T1553.001
display_name: 'Subvert Trust Controls: Gatekeeper Bypass'
atomic_tests:
- name: Gatekeeper Bypass
  auto_generated_guid: fb3d46c6-9480-4803-8d7d-ce676e1f1a9b
  description: |
    Gatekeeper Bypass via command line
  supported_platforms:
  - macos
  input_arguments:
    app_path:
      description: Path to app to be used
      type: Path
      default: myapp.app
  executor:
    command: |
      sudo xattr -d com.apple.quarantine #{app_path}
    elevation_required: true
    name: sh
