T1564.014 — Extended Attributes

Tactic: Stealth · Platforms: Linux, macOS

Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like `Finder`, `ls`, or…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (2)

T1564.014 Hide Artifacts: Extended Attributes

title: "T1564.014 Hide Artifacts: Extended Attributes"
id: 71126614-54d3-4e06-a3e2-ee8074f26a70
description: 'Detection Strategy for Extended Attributes Abuse, matching the user. namespace string in either a1 or a2 to cover both the --name=/-v long-option and -n/-v short-flag setfattr invocation styles. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: XattrNamespaces, PayloadSizeThreshold, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/014
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.stealth
  - attack.t1564.014

logsource:
  category: process_creation
  product: linux

detection:
  selection_cmd:
    type: EXECVE
    a0|endswith: '/setfattr'
  selection_namespace:
    - a1|contains: 'user.'
    - a2|contains: 'user.'

  condition: selection_cmd and selection_namespace

falsepositives:
  - Legitimate use of extended attributes for SELinux labels, ACLs, or application metadata; auditd cannot inspect the xattr payload size directly from EXECVE argv, so the PayloadSizeThreshold tuning requires a separate getxattr/setxattr syscall audit rule.

level: medium

T1564.014 Hide Artifacts: Extended Attributes

title: "T1564.014 Hide Artifacts: Extended Attributes"
id: aa99909f-32a5-44f6-8229-cb6e4b4e4b7a
description: 'Detection Strategy for Extended Attributes Abuse. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedXattrKeys, EntropyThreshold, ProcessContext.'
references:
  - https://attack.mitre.org/techniques/T1564/014
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.stealth
  - attack.t1564.014

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/sh'
    CommandLine|contains: 'exec -a'

  condition: selection

falsepositives:
  - This only catches shell-level exec -a argv rewriting; native posix_spawn argument spoofing performed through the process creation API is invisible to unified log process_creation telemetry, so detection coverage for this technique is inherently weak on macOS.

level: medium

Related sub-techniques

Explore