Detect Extended Attributes in Splunk
Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide malicious data and evade detection. Extended attributes are key-value pairs of metadata attached to files and directories that are invisible to standard tools like ls, cat, and Finder. They require dedicated utilities — xattr on macOS, or getfattr/setfattr on Linux — for inspection. An adversary embeds a Base64-encoded second-stage payload into an xattr of a legitimate file (using xattr -w on macOS or setfattr on Linux), then a loader script retrieves the attribute value, decodes it, and pipes it to a scripting interpreter (bash, python, etc.) for execution. Because the primary file content and cryptographic hash remain unchanged, file integrity monitoring and hash-based detection will not flag the carrier file. This technique has been observed in Lazarus Group (APT38) campaigns where custom xattr names mimicking system attributes were used to store encrypted shellcode.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.014 Extended Attributes
- Canonical reference
- https://attack.mitre.org/techniques/T1564/014/
SPL Detection Query
index=linux sourcetype="linux:audit"
| eval cmd_lower=lower(proctitle)
| where (comm="xattr" OR comm="setfattr" OR comm="getfattr"
OR match(cmd_lower, "(setfattr|getfattr|xattr\s+-[wpn])"))
| eval WritingAttribute=if(match(cmd_lower, "(setfattr|xattr\s+-w\s|xattr\s+--set\s)"), 1, 0)
| eval ReadingAttribute=if(match(cmd_lower, "(getfattr\s+--only-values|xattr\s+-p\s|xattr\s+--print\s)"), 1, 0)
| eval HasBase64Pattern=if(match(cmd_lower, "(base64|frombase64|b64decode|b64encode)"), 1, 0)
| eval HasExecutionPipe=if(match(cmd_lower, "(\|bash|\|\s*bash|\|sh|\|\s*sh|\|python|\|\s*python|\|perl|exec\(|eval\()"), 1, 0)
| eval NonStandardNamespace=if(match(cmd_lower, "(user\.|trusted\.|security\.)") AND NOT match(cmd_lower, "(com\.apple\.quarantine|com\.apple\.metadata|com\.apple\.finderinfo)"), 1, 0)
| eval SuspicionScore=WritingAttribute + ReadingAttribute + HasBase64Pattern + HasExecutionPipe + NonStandardNamespace
| where SuspicionScore > 0
| table _time, host, uid, auid, comm, exe, proctitle, WritingAttribute, ReadingAttribute, HasBase64Pattern, HasExecutionPipe, NonStandardNamespace, SuspicionScore
| sort - _timeDetects xattr/setfattr/getfattr abuse on Linux systems using auditd logs. Monitors for attribute write operations, read extraction patterns combined with base64 decode, and execution piping into shell interpreters. Assigns a cumulative suspicion score across five indicators. Requires auditd configured with execve syscall rules: -a always,exit -F arch=b64 -S execve -k process_exec. The proctitle field in linux:audit (decoded by the Splunk Add-on for Unix and Linux) carries the full process argument list needed for command-line inspection.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Backup daemons (rsync --xattrs, tar --xattrs, Bacula, Amanda) running as service accounts during scheduled maintenance windows
- Package managers (apt, yum, rpm) and container runtimes accessing trusted. namespace attributes during installation and overlay filesystem operations
- Security baseline tools (AIDE, Tripwire, auditd itself) enumerating file attributes during scheduled integrity scans
- Developer build systems (Make, CMake, Gradle) and CI/CD runners using xattrs for build artifact tagging or cache metadata
- File manager applications and desktop environments writing user. namespace attributes for bookmark, tag, or thumbnail cache metadata
Other platforms for T1564.014
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1macOS: Embed Base64 Payload in Extended Attribute and Execute via Bash
Expected signal: DeviceProcessEvents (macOS Defender): (1) xattr process with ProcessCommandLine '-w user.hidden_loader <base64_string> /tmp/df00tech_xattr_carrier.txt'; (2) xattr process with ProcessCommandLine '-p user.hidden_loader /tmp/df00tech_xattr_carrier.txt'; (3) bash process spawned from the shell pipeline with the decoded command. Unified Log: xattr invocations under invoking shell process context. DeviceFileEvents: possible FileModified event for carrier file if EDR tracks xattr changes as metadata modifications.
- Test 2Linux: Store and Execute Payload via setfattr/getfattr in user. Namespace
Expected signal: auditd (requires execve rule): SYSCALL execve records for setfattr (TYPE=EXECVE with a[0]='setfattr', a[1]='-n', a[2]='user.system_metadata') and getfattr (with '--only-values'). DeviceProcessEvents (Defender for Linux): setfattr process with full command line, getfattr process with --only-values flag, bash process spawned via pipe. The carrier file hash (sha256sum /tmp/df00tech_config.json) remains identical before and after setfattr — demonstrating FIM evasion.
- Test 3Linux: Python Loader Extracting and Executing Xattr Payload In-Memory (APT-Style Stager)
Expected signal: auditd: setfattr execve record writing user.app_config attribute; python3 execve record with proctitle showing subprocess.check_output, getfattr, --only-values, base64.b64decode, exec(). getfattr invoked as child process of python3 (PPID of getfattr matches PID of python3). No additional file written to disk during execution — exec() runs the decoded Python code within the existing interpreter process. DeviceProcessEvents: python3 process with full command line containing all loader indicators.
- Test 4macOS: Verify Extended Attribute Persists Through Hash Integrity Check (FIM Evasion Proof)
Expected signal: DeviceProcessEvents: xattr process with CommandLine '-w user.evasion_test <base64_payload> /tmp/df00tech_fim_evasion_test.txt'. DeviceFileEvents: FileModified event for the carrier file if EDR tracks EA changes as file system events (EDR-dependent). SHA256 hash: identical before and after — file integrity monitoring tools relying solely on cryptographic hashes will NOT generate an alert. This outcome is expected and demonstrates the detection gap.
References (9)
- https://attack.mitre.org/techniques/T1564/014/
- https://kernal.eu/posts/linux-xattr-persistence/
- https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/
- https://ss64.com/mac/xattr.html
- https://linux.die.net/man/1/setfattr
- https://linux.die.net/man/1/getfattr
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.014/T1564.014.md
- https://objective-see.org/blog/blog_0x25.html
- https://learn.microsoft.com/en-us/defender-endpoint/linux-support-install
Unlock Pro Content
Get the full detection package for T1564.014 including response playbook, investigation guide, and atomic red team tests.