Detect Extended Attributes in Microsoft Sentinel
Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide malicious data and evade detection. Extended attributes are key-value pairs of metadata attached to files and directories that are invisible to standard tools like ls, cat, and Finder. They require dedicated utilities — xattr on macOS, or getfattr/setfattr on Linux — for inspection. An adversary embeds a Base64-encoded second-stage payload into an xattr of a legitimate file (using xattr -w on macOS or setfattr on Linux), then a loader script retrieves the attribute value, decodes it, and pipes it to a scripting interpreter (bash, python, etc.) for execution. Because the primary file content and cryptographic hash remain unchanged, file integrity monitoring and hash-based detection will not flag the carrier file. This technique has been observed in Lazarus Group (APT38) campaigns where custom xattr names mimicking system attributes were used to store encrypted shellcode.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.014 Extended Attributes
- Canonical reference
- https://attack.mitre.org/techniques/T1564/014/
KQL Detection Query
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOSPlatform in~ ("macOS", "Linux")
| where (
// macOS: xattr write (embedding payload)
(FileName =~ "xattr" and ProcessCommandLine has_any ("-w ", "--set ", "-wx ")) or
// Linux: setfattr (embedding payload into user. namespace)
(FileName =~ "setfattr" and ProcessCommandLine has "-n ") or
// Linux: getfattr extraction — especially --only-values used by loaders
(FileName =~ "getfattr" and ProcessCommandLine has_any ("--only-values", "-e ")) or
// macOS: xattr read (retrieving payload)
(FileName =~ "xattr" and ProcessCommandLine has_any ("-p ", "--print ")) or
// Shell/interpreter invoked with parent chain showing xattr read
(FileName in~ ("bash", "sh", "zsh", "python", "python3", "perl", "ruby") and
InitiatingProcessFileName in~ ("xattr", "getfattr", "bash", "sh", "zsh") and
InitiatingProcessCommandLine has_any ("xattr -p", "getfattr --only-values", "base64 -d", "base64 --decode"))
)
// Enrich with suspicious indicators
| extend HasBase64Pattern = ProcessCommandLine has_any ("base64", "base64 -d", "--decode", "frombase64", "b64decode")
| extend HasExecutionPipe = ProcessCommandLine has_any ("|bash", "| bash", "|sh", "| sh", "|python", "| python", "|perl", "| perl", "exec(", "eval(")
| extend WritingAttribute = (FileName in~ ("xattr", "setfattr")) and ProcessCommandLine has_any ("-w ", "--set ", "-n ")
| extend ReadingAttribute = (FileName =~ "xattr" and ProcessCommandLine has_any ("-p ", "--print ")) or (FileName =~ "getfattr" and ProcessCommandLine has "--only-values")
| extend NonStandardNamespace = ProcessCommandLine has_any ("user.", "trusted.", "security.") and not ProcessCommandLine has_any ("com.apple.quarantine", "com.apple.metadata", "com.apple.FinderInfo", "com.apple.lastuseddate", "com.apple.ResourceFork")
| extend SuspicionScore = toint(HasBase64Pattern) + toint(HasExecutionPipe) + toint(NonStandardNamespace) + toint(WritingAttribute) + toint(ReadingAttribute)
| project Timestamp, DeviceName, DeviceOSPlatform, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
WritingAttribute, ReadingAttribute, HasBase64Pattern, HasExecutionPipe, NonStandardNamespace, SuspicionScore
| sort by Timestamp descDetects extended attribute (xattr/setfattr/getfattr) abuse on macOS and Linux endpoints managed by Microsoft Defender for Endpoint. Monitors for attribute write operations embedding payloads, read operations combined with base64 decode or execution pipes, and shell interpreters spawned from xattr utilities. Assigns a suspicion score across five indicators: write ops, read ops, base64 patterns, execution pipes, and non-standard attribute namespaces. Filters out known-legitimate macOS system attributes (com.apple.*) to reduce noise.
Data Sources
Required Tables
False Positives & Tuning
- macOS Gatekeeper and Spotlight legitimately use com.apple.quarantine, com.apple.metadata:*, and com.apple.FinderInfo attributes — excluded by the NonStandardNamespace filter
- Backup and archiving tools (rsync --xattrs, tar --xattrs, macOS Time Machine) regularly read and write extended attributes during scheduled backup operations
- File tagging applications and Digital Asset Management (DAM) software write custom xattrs for organizational metadata and workflow state
- Container runtimes (Docker overlay2, Podman) and package managers use trusted. namespace attributes on Linux for filesystem layer tracking
- Security baseline scanning tools (AIDE, Tripwire) reading all file metadata including xattrs during scheduled integrity baseline runs
Other platforms for T1564.014
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1macOS: Embed Base64 Payload in Extended Attribute and Execute via Bash
Expected signal: DeviceProcessEvents (macOS Defender): (1) xattr process with ProcessCommandLine '-w user.hidden_loader <base64_string> /tmp/df00tech_xattr_carrier.txt'; (2) xattr process with ProcessCommandLine '-p user.hidden_loader /tmp/df00tech_xattr_carrier.txt'; (3) bash process spawned from the shell pipeline with the decoded command. Unified Log: xattr invocations under invoking shell process context. DeviceFileEvents: possible FileModified event for carrier file if EDR tracks xattr changes as metadata modifications.
- Test 2Linux: Store and Execute Payload via setfattr/getfattr in user. Namespace
Expected signal: auditd (requires execve rule): SYSCALL execve records for setfattr (TYPE=EXECVE with a[0]='setfattr', a[1]='-n', a[2]='user.system_metadata') and getfattr (with '--only-values'). DeviceProcessEvents (Defender for Linux): setfattr process with full command line, getfattr process with --only-values flag, bash process spawned via pipe. The carrier file hash (sha256sum /tmp/df00tech_config.json) remains identical before and after setfattr — demonstrating FIM evasion.
- Test 3Linux: Python Loader Extracting and Executing Xattr Payload In-Memory (APT-Style Stager)
Expected signal: auditd: setfattr execve record writing user.app_config attribute; python3 execve record with proctitle showing subprocess.check_output, getfattr, --only-values, base64.b64decode, exec(). getfattr invoked as child process of python3 (PPID of getfattr matches PID of python3). No additional file written to disk during execution — exec() runs the decoded Python code within the existing interpreter process. DeviceProcessEvents: python3 process with full command line containing all loader indicators.
- Test 4macOS: Verify Extended Attribute Persists Through Hash Integrity Check (FIM Evasion Proof)
Expected signal: DeviceProcessEvents: xattr process with CommandLine '-w user.evasion_test <base64_payload> /tmp/df00tech_fim_evasion_test.txt'. DeviceFileEvents: FileModified event for the carrier file if EDR tracks EA changes as file system events (EDR-dependent). SHA256 hash: identical before and after — file integrity monitoring tools relying solely on cryptographic hashes will NOT generate an alert. This outcome is expected and demonstrates the detection gap.
References (9)
- https://attack.mitre.org/techniques/T1564/014/
- https://kernal.eu/posts/linux-xattr-persistence/
- https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/
- https://ss64.com/mac/xattr.html
- https://linux.die.net/man/1/setfattr
- https://linux.die.net/man/1/getfattr
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.014/T1564.014.md
- https://objective-see.org/blog/blog_0x25.html
- https://learn.microsoft.com/en-us/defender-endpoint/linux-support-install
Unlock Pro Content
Get the full detection package for T1564.014 including response playbook, investigation guide, and atomic red team tests.