Glossary
XProtect
Apple's built-in anti-malware check, one of the tests Gatekeeper runs on the first launch of quarantined code on macOS.
XProtect is Apple's built-in anti-malware check. It is one of the tests Gatekeeper runs, alongside signature, Developer ID and notarization, when quarantined code is launched for the first time.
In download-provenance evidence, XProtect mostly appears through .LastGKReject, whose XProtectMalwareType key records a category for the last rejected item. Reported values, credited by mac_apt to Patrick Wardle and not documented by Apple, are 2 unsigned app/program, 3 modified bundle, 5 signed app and 7 modified app. Despite the key name, several of them describe signing state rather than a named malware family. See .LastGKReject and Gatekeeper evidence.