Detect Extended Attributes in CrowdStrike LogScale
Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide malicious data and evade detection. Extended attributes are key-value pairs of metadata attached to files and directories that are invisible to standard tools like ls, cat, and Finder. They require dedicated utilities — xattr on macOS, or getfattr/setfattr on Linux — for inspection. An adversary embeds a Base64-encoded second-stage payload into an xattr of a legitimate file (using xattr -w on macOS or setfattr on Linux), then a loader script retrieves the attribute value, decodes it, and pipes it to a scripting interpreter (bash, python, etc.) for execution. Because the primary file content and cryptographic hash remain unchanged, file integrity monitoring and hash-based detection will not flag the carrier file. This technique has been observed in Lazarus Group (APT38) campaigns where custom xattr names mimicking system attributes were used to store encrypted shellcode.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.014 Extended Attributes
- Canonical reference
- https://attack.mitre.org/techniques/T1564/014/
LogScale Detection Query
// T1564.014 — Extended Attributes abuse detection (macOS and Linux)
// Primary: xattr/setfattr/getfattr execution with suspicious indicators
#event_simpleName=ProcessRollup2
| ImageFileName = /\/(xattr|setfattr|getfattr)$/
| CommandLine = /(setfattr|getfattr|xattr\s+-[wpn])/i
| case {
CommandLine = /(setfattr|xattr\s+-w\s|xattr\s+--set\s)/i | WritingAttribute := "true" ;
* | WritingAttribute := "false"
}
| case {
CommandLine = /(getfattr\s+--only-values|xattr\s+-p\s|xattr\s+--print\s)/i | ReadingAttribute := "true" ;
* | ReadingAttribute := "false"
}
| case {
CommandLine = /(base64|frombase64|b64decode)/i | HasBase64Pattern := "true" ;
* | HasBase64Pattern := "false"
}
| case {
CommandLine = /(\|bash|\|\s*bash|\|sh|\|\s*sh|\|python|exec\(|eval\()/i | HasExecutionPipe := "true" ;
* | HasExecutionPipe := "false"
}
| case {
CommandLine = /(user\.|trusted\.|security\.)/i
AND CommandLine != /(com\.apple\.quarantine|com\.apple\.metadata|com\.apple\.finderinfo|com\.apple\.lastuseddate|com\.apple\.resourcefork)/i
| NonStandardNamespace := "true" ;
* | NonStandardNamespace := "false"
}
| SuspicionScore := (WritingAttribute="true" ? 1 : 0)
+ (ReadingAttribute="true" ? 1 : 0)
+ (HasBase64Pattern="true" ? 1 : 0)
+ (HasExecutionPipe="true" ? 1 : 0)
+ (NonStandardNamespace="true" ? 1 : 0)
| SuspicionScore > 0
| table([@timestamp, ComputerName, UserName, aid, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, WritingAttribute, ReadingAttribute, HasBase64Pattern, HasExecutionPipe, NonStandardNamespace, SuspicionScore])
| sort(field=@timestamp, order=desc)
// Supplemental: interpreter spawned by xattr/getfattr parent chain
| join type=left
(
#event_simpleName=ProcessRollup2
| ImageFileName = /\/(bash|sh|zsh|python3?|perl|ruby)$/
| ParentBaseFileName = /(xattr|getfattr|bash|sh|zsh)/i
| ParentCommandLine = /(xattr\s+-p|getfattr\s+--only-values|base64\s+-d|base64\s+--decode)/i
| table([TargetProcessId, ComputerName, CommandLine, ParentBaseFileName, ParentCommandLine])
)
on (ComputerName)CrowdStrike LogScale (CQL) detection for Extended Attribute abuse (T1564.014) using Falcon ProcessRollup2 telemetry. Primary query scores xattr/setfattr/getfattr executions across five behavioral indicators. Supplemental join correlates interpreter spawning events where the parent process chain shows xattr read followed by base64 decode, covering the full Lazarus-style loader pattern.
Data Sources
Required Tables
False Positives & Tuning
- macOS System Integrity Protection (SIP) and Transparency, Consent, and Control (TCC) frameworks that write and read com.apple.* extended attributes on system files — tune by excluding ImageFileName paths under /System/ and /Library/
- Homebrew package manager on macOS, which uses xattr to manage quarantine flags and custom metadata on downloaded package archives and compiled binaries during install and upgrade operations
- Linux containers using overlay filesystems (Docker, Podman) where the container runtime calls setfattr with trusted.overlay.* namespace attributes as part of copy-on-write layer management
Other platforms for T1564.014
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1macOS: Embed Base64 Payload in Extended Attribute and Execute via Bash
Expected signal: DeviceProcessEvents (macOS Defender): (1) xattr process with ProcessCommandLine '-w user.hidden_loader <base64_string> /tmp/df00tech_xattr_carrier.txt'; (2) xattr process with ProcessCommandLine '-p user.hidden_loader /tmp/df00tech_xattr_carrier.txt'; (3) bash process spawned from the shell pipeline with the decoded command. Unified Log: xattr invocations under invoking shell process context. DeviceFileEvents: possible FileModified event for carrier file if EDR tracks xattr changes as metadata modifications.
- Test 2Linux: Store and Execute Payload via setfattr/getfattr in user. Namespace
Expected signal: auditd (requires execve rule): SYSCALL execve records for setfattr (TYPE=EXECVE with a[0]='setfattr', a[1]='-n', a[2]='user.system_metadata') and getfattr (with '--only-values'). DeviceProcessEvents (Defender for Linux): setfattr process with full command line, getfattr process with --only-values flag, bash process spawned via pipe. The carrier file hash (sha256sum /tmp/df00tech_config.json) remains identical before and after setfattr — demonstrating FIM evasion.
- Test 3Linux: Python Loader Extracting and Executing Xattr Payload In-Memory (APT-Style Stager)
Expected signal: auditd: setfattr execve record writing user.app_config attribute; python3 execve record with proctitle showing subprocess.check_output, getfattr, --only-values, base64.b64decode, exec(). getfattr invoked as child process of python3 (PPID of getfattr matches PID of python3). No additional file written to disk during execution — exec() runs the decoded Python code within the existing interpreter process. DeviceProcessEvents: python3 process with full command line containing all loader indicators.
- Test 4macOS: Verify Extended Attribute Persists Through Hash Integrity Check (FIM Evasion Proof)
Expected signal: DeviceProcessEvents: xattr process with CommandLine '-w user.evasion_test <base64_payload> /tmp/df00tech_fim_evasion_test.txt'. DeviceFileEvents: FileModified event for the carrier file if EDR tracks EA changes as file system events (EDR-dependent). SHA256 hash: identical before and after — file integrity monitoring tools relying solely on cryptographic hashes will NOT generate an alert. This outcome is expected and demonstrates the detection gap.
References (9)
- https://attack.mitre.org/techniques/T1564/014/
- https://kernal.eu/posts/linux-xattr-persistence/
- https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/
- https://ss64.com/mac/xattr.html
- https://linux.die.net/man/1/setfattr
- https://linux.die.net/man/1/getfattr
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.014/T1564.014.md
- https://objective-see.org/blog/blog_0x25.html
- https://learn.microsoft.com/en-us/defender-endpoint/linux-support-install
Unlock Pro Content
Get the full detection package for T1564.014 including response playbook, investigation guide, and atomic red team tests.