Files
nuclei-templates/code/macos/audit/gatekeeper-disabled.yaml
2025-11-10 09:32:25 +00:00

27 lines
912 B
YAML

id: gatekeeper-disabled
info:
name: macOS Gatekeeper Disabled
author: geeknik
severity: high
description: |
Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
impact: |
Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
remediation: |
Enable Gatekeeper to ensure that only applications from identified developers can be run.
tags: macos,audit,local,security
self-contained: true
code:
- engine:
- sh
- bash
source: |
spctl --status
matchers:
- type: word
words:
- "assessments disabled"
# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950