AN0951: Analytic 0951
Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.
Analyst context for executives and security teams
AN0951 is a macOS detection analytic focused on a high-value integrity problem: applications or system-library binaries being modified and then run without valid signing or notarization trust. For leaders, this matters because macOS application trust controls are often assumed to reduce risk, but that assumption only holds if the organization can see when trusted locations are altered and when modified binaries execute afterward.
Executive priority
Prioritize this analytic where macOS endpoints support business-critical users, privileged administrators, developers, or regulated workflows. The decision value is to validate whether endpoint monitoring can prove application integrity, code-signing status, and Gatekeeper or notarization-related bypass activity. This can support incident triage, control assurance, and audit evidence around endpoint hardening, but coverage should not be assumed because MITRE provides no detailed detection logic for this analytic.
Technical view
For SOC, detection engineering, and IR teams, validate collection and correlation on macOS for binary modification events in /Applications and system library paths, subsequent execution of those modified binaries, code-signing or signature-validation results, and Gatekeeper or notarization bypass indicators tied to the same file. Because no ATT&CK tactic or relationship context is supplied, treat this as an analytic validation target rather than a complete detection rule. The core engineering question is whether file modification, execution, and trust-verification telemetry can be joined reliably by path, file hash, signing state, timestamp, and host.
Likely telemetry
- macOS file modification events for /Applications and system library paths
- Process execution events for binaries in those paths
- Code-signing validation results, including unsigned or improperly signed binaries
- Gatekeeper-related events associated with modified binaries
- Notarization or trust-assessment outcomes where available
Detection direction
- Confirm that monitoring covers both /Applications and relevant system library paths on macOS endpoints.
- Correlate binary modification with later execution rather than alerting only on one event type in isolation.
- Tune for legitimate software updates, enterprise packaging, and administrator-driven application changes to reduce false positives.
- Prioritize cases where a modified binary executes and is unsigned, improperly signed, or associated with Gatekeeper/notarization bypass indicators.
- Validate whether endpoint tools preserve enough file identity data, such as hashes and signing state, before and after modification.
Mitigation priorities
- Maintain reliable macOS endpoint visibility before relying on this analytic for assurance.
- Enforce standard software installation and update paths so legitimate binary changes are easier to distinguish from suspicious modification.
- Use application trust controls such as signing, Gatekeeper, and notarization validation where available and operationally appropriate.
- Restrict unnecessary administrative access that can modify application and system library locations.
- Include macOS application integrity evidence in incident response playbooks and compliance control testing.
Analyst notes and limits
This object is a detection analytic, not a technique description. The supplied ATT&CK fields identify the platform as macOS and describe the behavior to monitor, but do not provide tactics, detection pseudocode, data source mappings, mitigations, or relationships. Local engineering is required to turn this into a deployable rule and to define acceptable software-change baselines.
Official detection content is not provided, and no relationship context is supplied. This take does not infer adversary use, active exploitation, impact, attribution, or guaranteed detectability. Effectiveness depends on local macOS telemetry, endpoint configuration, software management practices, and available code-signing/Gatekeeper/notarization evidence.
Analytic 0951
Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | ced856124270… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0951Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.