Detect Extended Attributes in Sumo Logic CSE
Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide malicious data and evade detection. Extended attributes are key-value pairs of metadata attached to files and directories that are invisible to standard tools like ls, cat, and Finder. They require dedicated utilities — xattr on macOS, or getfattr/setfattr on Linux — for inspection. An adversary embeds a Base64-encoded second-stage payload into an xattr of a legitimate file (using xattr -w on macOS or setfattr on Linux), then a loader script retrieves the attribute value, decodes it, and pipes it to a scripting interpreter (bash, python, etc.) for execution. Because the primary file content and cryptographic hash remain unchanged, file integrity monitoring and hash-based detection will not flag the carrier file. This technique has been observed in Lazarus Group (APT38) campaigns where custom xattr names mimicking system attributes were used to store encrypted shellcode.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.014 Extended Attributes
- Canonical reference
- https://attack.mitre.org/techniques/T1564/014/
Sumo Detection Query
(_sourceCategory="linux/audit" OR _sourceCategory="macos/endpoint" OR _sourceCategory="os/linux" OR _sourceCategory="crowdstrike/fdr")
| where !(isNull(proctitle) or proctitle="")
| toLowerCase(proctitle) as cmd_lower
| where (
(comm = "xattr" or comm = "setfattr" or comm = "getfattr")
or matches(cmd_lower, ".*(setfattr|getfattr|xattr\s+-[wpn]).*")
or (
matches(cmd_lower, ".*(bash|sh|zsh|python|python3|perl|ruby).*")
and matches(parent_process, ".*(xattr|getfattr).*")
and matches(parent_cmdline, ".*(xattr -p|getfattr --only-values|base64 -d|base64 --decode).*")
)
)
| if(matches(cmd_lower, ".*(setfattr|xattr\s+-w\s|xattr\s+--set\s).*"), 1, 0) as WritingAttribute
| if(matches(cmd_lower, ".*(getfattr\s+--only-values|xattr\s+-p\s|xattr\s+--print\s).*"), 1, 0) as ReadingAttribute
| if(matches(cmd_lower, ".*(base64|frombase64|b64decode|b64encode).*"), 1, 0) as HasBase64Pattern
| if(matches(cmd_lower, ".(\\|bash|\\|\\s*bash|\\|sh|\\|\\s*sh|\\|python|exec\\(|eval\\().*"), 1, 0) as HasExecutionPipe
| if(
matches(cmd_lower, ".*(user\\.|trusted\\.|security\\.).*")
and !matches(cmd_lower, ".*(com\\.apple\\.quarantine|com\\.apple\\.metadata|com\\.apple\\.finderinfo|com\\.apple\\.lastuseddate|com\\.apple\\.resourcefork).*"),
1, 0
) as NonStandardNamespace
| WritingAttribute + ReadingAttribute + HasBase64Pattern + HasExecutionPipe + NonStandardNamespace as SuspicionScore
| where SuspicionScore > 0
| fields _messagetime, host, uid, auid, comm, exe, proctitle, parent_process, parent_cmdline, WritingAttribute, ReadingAttribute, HasBase64Pattern, HasExecutionPipe, NonStandardNamespace, SuspicionScore
| sort by _messagetime descSumo Logic detection for Extended Attribute (xattr/setfattr/getfattr) abuse on macOS and Linux systems. Computes a suspicion score across five behavioral indicators: writing attributes, reading attributes, base64 encoding patterns, execution pipe chains, and non-standard xattr namespaces. Supports both audit log and EDR telemetry source categories.
Data Sources
Required Tables
False Positives & Tuning
- macOS Gatekeeper and Quarantine workflows where security software legitimately calls xattr -d com.apple.quarantine after validating downloaded applications — adjust the NonStandardNamespace filter to suppress known quarantine management processes
- Extended attribute-aware backup solutions (Veeam, Acronis, Time Machine internals) that iterate over all file xattrs to preserve filesystem metadata, generating high volumes of getfattr/xattr read events
- SELinux and AppArmor policy enforcement processes on Linux that use setfattr to apply or restore security.selinux labels during policy reload or file relabeling operations
Other platforms for T1564.014
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1macOS: Embed Base64 Payload in Extended Attribute and Execute via Bash
Expected signal: DeviceProcessEvents (macOS Defender): (1) xattr process with ProcessCommandLine '-w user.hidden_loader <base64_string> /tmp/df00tech_xattr_carrier.txt'; (2) xattr process with ProcessCommandLine '-p user.hidden_loader /tmp/df00tech_xattr_carrier.txt'; (3) bash process spawned from the shell pipeline with the decoded command. Unified Log: xattr invocations under invoking shell process context. DeviceFileEvents: possible FileModified event for carrier file if EDR tracks xattr changes as metadata modifications.
- Test 2Linux: Store and Execute Payload via setfattr/getfattr in user. Namespace
Expected signal: auditd (requires execve rule): SYSCALL execve records for setfattr (TYPE=EXECVE with a[0]='setfattr', a[1]='-n', a[2]='user.system_metadata') and getfattr (with '--only-values'). DeviceProcessEvents (Defender for Linux): setfattr process with full command line, getfattr process with --only-values flag, bash process spawned via pipe. The carrier file hash (sha256sum /tmp/df00tech_config.json) remains identical before and after setfattr — demonstrating FIM evasion.
- Test 3Linux: Python Loader Extracting and Executing Xattr Payload In-Memory (APT-Style Stager)
Expected signal: auditd: setfattr execve record writing user.app_config attribute; python3 execve record with proctitle showing subprocess.check_output, getfattr, --only-values, base64.b64decode, exec(). getfattr invoked as child process of python3 (PPID of getfattr matches PID of python3). No additional file written to disk during execution — exec() runs the decoded Python code within the existing interpreter process. DeviceProcessEvents: python3 process with full command line containing all loader indicators.
- Test 4macOS: Verify Extended Attribute Persists Through Hash Integrity Check (FIM Evasion Proof)
Expected signal: DeviceProcessEvents: xattr process with CommandLine '-w user.evasion_test <base64_payload> /tmp/df00tech_fim_evasion_test.txt'. DeviceFileEvents: FileModified event for the carrier file if EDR tracks EA changes as file system events (EDR-dependent). SHA256 hash: identical before and after — file integrity monitoring tools relying solely on cryptographic hashes will NOT generate an alert. This outcome is expected and demonstrates the detection gap.
References (9)
- https://attack.mitre.org/techniques/T1564/014/
- https://kernal.eu/posts/linux-xattr-persistence/
- https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/
- https://ss64.com/mac/xattr.html
- https://linux.die.net/man/1/setfattr
- https://linux.die.net/man/1/getfattr
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.014/T1564.014.md
- https://objective-see.org/blog/blog_0x25.html
- https://learn.microsoft.com/en-us/defender-endpoint/linux-support-install
Unlock Pro Content
Get the full detection package for T1564.014 including response playbook, investigation guide, and atomic red team tests.