VORANT. Threat Intelligence Sign in Get the full feed

Objective-See details macOS App Translocation bypass

routine vulnerability technology

A researcher explains how Apple's App Translocation security feature broke his macOS tools and how to programmatically 'untranslocate' apps to restore functionality.

This blog post from Objective-See's Patrick Wardle recounts his prior research into Gatekeeper bypasses (CVE-2015-3715 and CVE-2015-7024) that abused unsigned external content referenced by signed macOS applications, such as dylib hijacking and dynamic execution of unverified binaries. Apple's comprehensive fix for these issues, introduced in macOS Sierra as 'App Translocation' (Gatekeeper Path Randomization), mounts downloaded applications in a randomized, read-only location to prevent access to unverified external content.

While effective as a security mitigation, App Translocation broke legitimate functionality in several of the author's tools, including TaskExplorer, which needed to modify its own bundle (e.g., setuid an XPC service) at runtime. The author evaluates several Apple-suggested workarounds—refactoring with SMJobBless, moving the app bundle, creating installers, signed DMGs, and signed XIP archives—and finds each impractical or broken. He ultimately presents a technique using undocumented/private Security.framework APIs (SecTranslocateIsTranslocatedURL and SecTranslocateCreateOriginalPathForURL) to detect translocation, strip the com.apple.quarantine attribute from the original app copy, and relaunch it from its original location, effectively bypassing App Translocation's restrictions transparently to the end user.

This is a research/developer-focused writeup rather than an active threat report; it describes a legitimate technique to restore app functionality but also documents an approach that could theoretically be leveraged to circumvent a macOS security control using private APIs.

Mentioned in this report

Vulnerabilities CVE-2015-3715CVE-2015-7024

Detection guidance

macOS App Calling Private Security Framework Translocation APIs

ATT&CK T1553.001

Detects process invoking undocumented SecTranslocate* functions (SecTranslocateIsTranslocatedURL, SecTranslocateCreateOriginalPathForURL) to bypass App Translocation restrictions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS App Calling Private Security Framework Translocation APIs
description: Detects calls to private Security.framework APIs (SecTranslocateIsTranslocatedURL,
  SecTranslocateCreateOriginalPathForURL) used to detect and circumvent App Translocation.
  These APIs are undocumented and not intended for general use; legitimate apps use
  public APIs or installers to handle bundle modifications.
tags:
- attack.defense-evasion
- attack.t1553.001
logsource:
  category: image_load
  product: macos
detection:
  selection:
    ImageLoaded|contains: /System/Library/Frameworks/Security.framework
  selection_api_calls:
    APICall|contains:
    - SecTranslocateIsTranslocatedURL
    - SecTranslocateCreateOriginalPathForURL
  condition: selection and selection_api_calls
falsepositives:
- Apple internal tools or system processes (rare)
- Security research and reverse engineering tools explicitly inspecting translocation
level: high
id: 882650be-519a-59a9-8b61-04d5660c4e19
status: experimental
author: Vorant

macOS App Removing Quarantine Attribute Before Execution

ATT&CK T1553.001

Detects process removing com.apple.quarantine extended attribute from application bundle and subsequently executing it, bypassing Gatekeeper validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS App Removing Quarantine Attribute Before Execution
description: Detects removal of com.apple.quarantine extended attribute (xattr) followed
  by execution of the same binary or a binary within the same bundle. This pattern
  is used to strip Gatekeeper metadata and execute untrusted code.
tags:
- attack.defense-evasion
- attack.t1553.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_xattr_remove:
    CommandLine|contains:
    - xattr -d com.apple.quarantine
    - xattr -rd com.apple.quarantine
  selection_exec_after:
    CommandLine|contains:
    - '&&'
    - ;
  condition: selection_xattr_remove and selection_exec_after
falsepositives:
- Legitimate installer scripts or deployment tools removing quarantine for distribution
  purposes
- User manual xattr removal during app installation workflow
level: medium
id: 66bf2869-9867-5e2a-920c-78b2e64c6b42
status: experimental
author: Vorant

macOS Process Relaunching From Non-Standard Path After Translocation Detection

ATT&CK T1574.001

Detects process detecting App Translocation status and relaunching itself from original (non-randomized) application path, bypassing mount-based restrictions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Relaunching From Non-Standard Path After Translocation Detection
description: Detects application detecting translocation status and then relaunching
  itself from the original, non-randomized app path. Translocation mounts apps in
  randomized /var/folders paths; relaunching from standard /Applications or user paths
  after translocation detection indicates circumvention of App Translocation restrictions.
tags:
- attack.defense-evasion
- attack.t1553.001
- attack.t1574.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains: /var/folders
    Image|contains:
    - /Applications/
    - /Users/
    Image|endswith: .app/Contents/MacOS
  filter_installer:
    Image|contains: Install
  filter_dmg_mount:
    ParentImage|contains: /Volumes/
  condition: selection and not filter_installer and not filter_dmg_mount
falsepositives:
- Legitimate application launcher utilities
- DMG-based installers that extract and relaunch apps
level: medium
id: 1acd4e6c-c658-579b-83ba-47afd0ab28a5
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x15.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free