diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 3692e672..aa41f5d5 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -6569,10 +6569,9 @@ defense-evasion: type: path default: myapp.app executor: - command: 'sudo xattr -d com.apple.quarantine #{app_path} + command: 'xattr -d com.apple.quarantine #{app_path} ' - elevation_required: true name: sh T1553.002: technique: diff --git a/atomics/Indexes/macos-index.yaml b/atomics/Indexes/macos-index.yaml index 970b5d33..ea209ba6 100644 --- a/atomics/Indexes/macos-index.yaml +++ b/atomics/Indexes/macos-index.yaml @@ -3500,10 +3500,9 @@ defense-evasion: type: path default: myapp.app executor: - command: 'sudo xattr -d com.apple.quarantine #{app_path} + command: 'xattr -d com.apple.quarantine #{app_path} ' - elevation_required: true name: sh T1553.002: technique: diff --git a/atomics/T1553.001/T1553.001.md b/atomics/T1553.001/T1553.001.md index b0444423..1cc4f037 100644 --- a/atomics/T1553.001/T1553.001.md +++ b/atomics/T1553.001/T1553.001.md @@ -45,11 +45,11 @@ Gatekeeper Bypass via command line | app_path | Path to app to be used | path | myapp.app| -#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin) +#### Attack Commands: Run with `sh`! ```sh -sudo xattr -d com.apple.quarantine #{app_path} +xattr -d com.apple.quarantine #{app_path} ```