# xattr

> Display and manipulate extended attributes.

The xattr command can be used to display, modify or remove the extended attributes of one or more files, including directories and symbolic links.  Extended attributes are arbitrary metadata stored with a file, but separate from the filesystem attributes (such as modification time or file size).  The metadata is often a null-terminated UTF-8 string, but can also be arbitrary binary data.  xattr can be used to bypass Gatekeeper.

- Page: https://loobins.io/binaries/xattr/
- Author: Jason Trost (@jason_trost)
- Created: 2023-04-20
- Tactics: Execution, Defense Evasion

## Paths

- `/usr/bin/xattr`

## Example Use Cases

### Bypass Gatekeeper via xattr

Use xattr to remove quarantine extended attribute from a file.

```bash
xattr -d com.apple.quarantine FILE
```

- Tactics: Execution, Defense Evasion
- Tags: xattr, quarantine

### Bypass Gatekeeper via xattr

Use xattr to remove quarantine extended attribute from multiple files or directories.

```bash
xattr -d -r com.apple.quarantine *
```

- Tactics: Execution, Defense Evasion
- Tags: xattr, quarantine

### Clear extended attributes from a file via xattr

Use xattr -c to clear a file's extended attributes. This removes com.apple.quarantine when present without naming it, so the command line does not contain the string com.apple.quarantine. AMOS ran this form on a dropped payload before executing it.

```bash
xattr -c FILE
```

- Tactics: Execution, Defense Evasion
- Tags: xattr, quarantine

### Recursively clear extended attributes via xattr

Use xattr -cr to clear extended attributes, including com.apple.quarantine, across an app bundle or directory tree. Seen in MacSync and CrashStealer infections.

```bash
xattr -cr DIRECTORY
```

- Tactics: Execution, Defense Evasion
- Tags: xattr, quarantine

## Detections

- [Gatekeeper Bypass via Xattr](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml)
- [Jamf Protect: Detect activity related to xattr and extended attributes](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/xattr_extended_attributes_activity)

## Resources

- [Threat Hunting the macOS edition Megan Carney (Report)](https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf)
- [GrrCon 2018: Threat Hunting the macOS edition Megan Carney](https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be)
- [A new version of the MacSync macOS stealer targets crypto enthusiasts and developers](https://securelist.com/macsync-new-version/121383)
- [Field Effect detects AMOS Stealer delivered via Cursor AI agent session](https://fieldeffect.com/blog/field-effect-detects-amos-stealer-delivered-via-cursor-ai-agent-session)
- [CrashStealer: C++ macOS infostealer posing as crash reporter](https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/)

## Acknowledgements

- Liran Ravich (Cribl) - clear-all (-c / -cr) use cases