T1564.014sub-technique of T1564 Hide Artifacts

Extended Attributes

Linux · macOSnothing on this site yetT1564.014 on attack.mitre.org

Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like `Finder`, `ls`, or `cat` and require utilities such as `xattr` (macOS) or `getfattr` (Linux) for inspection.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Extended Attributes Abuse

Abuse of extended attributes (xattrs) to embed hidden payloads into legitimate files. Defender perspective: detect anomalous use of setfattr or getfattr commands, or direct syscalls (setxattr, getxattr) where attributes are unusually large or contain encoded data.
Abuse of extended attributes (xattrs) to hide payloads in com.apple.* or custom keys. Defender perspective: monitor suspicious use of xattr command with -w (write) and -p (print) flags, especially when followed by execution of interpreters like bash, Python, or osascript.

what reduces it

M1040 Behavior Prevention on Endpoint. During artifact review, packaging, or deployment stages, scan extended attributes alongside file contents to detect hidden payloads, obfuscated data, or suspicious attribute keys that may indicate malicious behavior.

the rest of T1564

T1564.001 Hidden Files and Directories · not covered yet
T1564.002 Hidden Users · not covered yet
T1564.003 Hidden Window · not covered yet
T1564.004 NTFS File Attributes · not covered yet
T1564.005 Hidden File System · not covered yet
T1564.006 Run Virtual Instance · not covered yet
T1564.007 VBA Stomping · not covered yet
T1564.008 Email Hiding Rules · 2 on this site
T1564.009 Resource Forking · not covered yet
T1564.010 Process Argument Spoofing · not covered yet
T1564.011 Ignore Process Interrupts · not covered yet
T1564.012 File/Path Exclusions · not covered yet
T1564.013 Bind Mounts · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.