Extended Attributes: Hidden Payloads in Plain Files (T1564.014)

A file can look unchanged and still carry something extra. MITRE T1564.014, Extended Attributes, is about hiding data in the metadata that macOS and Linux attach to files. It sits under the stealth tactic and applies to Linux and macOS.

What extended attributes are

Extended attributes, or xattrs, are key-value pairs of metadata on files and directories. Both operating systems use them for tagging, integrity checks and access control. They do not show up in tools like Finder, ls or cat. You need xattr on macOS or getfattr on Linux to see them.

On Linux, xattrs are organized into namespaces: user. for user permissions, trusted. for root, plus security. and system., each with its own rules. On macOS, xattrs are flat strings with no namespace prefix, and the system ones begin with com.apple., for example com.apple.quarantine, which Gatekeeper uses, or com.apple.metadata:_kMDItemUserTags, which Spotlight uses.

How attackers use it

MITRE describes embedding a second-stage payload in the extended attribute of a legitimate file.

• On macOS, a payload can be written into a custom attribute with xattr. A separate loader reads it back with xattr -p, decodes the content and runs it with a scripting interpreter.
• On Linux, setfattr can write the payload into the user. namespace. A loader script extracts it with getfattr --only-values, decodes it and runs it with bash or another interpreter.

The key point from MITRE: the main file content does not change, so security tools and integrity checks that ignore extended attributes see the original file hash and the payload slips through.

Two parts are needed, a place to hide the data and a loader to use it. The loader is often the easier piece to catch.

How to detect it

MITRE's analytics describe a behavior chain on each platform.

Linux:

1. setfattr is run against suspicious namespaces such as user. or trusted..
2. File metadata changes that do not match the file's size or hash.
3. A process later reads the attribute and decodes it.

macOS:

1. A file gets new com.apple. or custom attributes.
2. The attribute content is inconsistent with what a metadata tag should hold, for example high entropy.
3. A process then reads it and runs an interpreter such as bash, Python or osascript.

The calls to watch for are the xattr command with the write and print flags, setfattr and getfattr, and the underlying setxattr and getxattr system calls, especially when the attributes are unusually large or hold encoded data.

Hash-based file integrity monitoring will not help here on its own, so add a check on attribute size and key names.

How to reduce the risk

MITRE lists one mitigation, Behavior Prevention on Endpoint: during artifact review, packaging or deployment, scan extended attributes alongside file contents to detect hidden payloads, obfuscated data or suspicious attribute keys.

That fits a build and release pipeline well. Anything that gets copied into a package, container image or release archive should be checked for attributes you did not intend to ship. Also keep endpoint tooling that records interpreter launches after attribute reads.

Check your own environment

Read-only inspection commands.

macOS:

xattr -l somefile
ls -l@ somefile

Linux, with the attr tools installed:

getfattr -d -m - somefile

The -m - option matches every namespace, so you see more than the default user. set. Looking across a directory tree, you can run the same command with -R and compare sizes. Ask yourself:

• Which attributes are normal on your fleet? com.apple.quarantine is expected on downloads. Large custom attributes are not.
• Do your release and packaging steps strip or inspect xattrs?
• Does your endpoint product alert on setfattr or xattr -w followed by an interpreter launch?

What to do if you find one

Do not run the loader to see what it does. Preserve the file and the attribute, record the process tree that read it, and treat the host as suspect until you know how the loader got there. Searching other hosts for the same attribute key is a fast way to scope the issue.

Quick check

Sources

• MITRE ATT&CK T1564.014, Extended Attributes