Cisco Secure Endpoint detects SupportApp as trying to evade Gatekeeper

[d3xbot]

When distributing the Support App, Cisco Secure Endpoint shows the following detection:

Description:

A quarantine flag is read by Gatekeeper, the security feature on macOS, to restrict execution when this file attribute is set. An attempt to remove this flag has been observed, which is unusual, and warrants further investigation. This technique can be used by malicious actors to bypass Gatekeeper protection.

File path:

file:///usr/bin/xattr

Command Line Arguments:

xattr -d -r com.apple. quarantine /Applications/Support.app

Plist file (added .txt to enable uploading to Github)
supportconfig.plist.txt

[kevinmcox]

Probably Line 29 in the package postinstall script.

https://github.com/root3nl/SupportApp/blob/master/pkgbuild/scripts/postinstall#L28-L29

[jordywitteman]

The specific action in the postinstall script was removed a while ago and this should be resolved.