xattr
The xattr command can be used to display, modify or remove the extended attributes of one or more files, including directories and symbolic links. Extended attributes are arbitrary metadata stored with a file, but separate from the filesystem attributes (such as modification time or file size). The metadata is often a null-terminated UTF-8 string, but can also be arbitrary binary data. xattr can be used to bypass Gatekeeper.
Paths
/usr/bin/xattr Example Use Cases
Bypass Gatekeeper via xattr #
Use xattr to remove quarantine extended attribute from a file.
xattr -d com.apple.quarantine FILEBypass Gatekeeper via xattr #
Use xattr to remove quarantine extended attribute from multiple files or directories.
xattr -d -r com.apple.quarantine *Clear extended attributes from a file via xattr #
Use xattr -c to clear a file's extended attributes. This removes com.apple.quarantine when present without naming it, so the command line does not contain the string com.apple.quarantine. AMOS ran this form on a dropped payload before executing it.
xattr -c FILERecursively clear extended attributes via xattr #
Use xattr -cr to clear extended attributes, including com.apple.quarantine, across an app bundle or directory tree. Seen in MacSync and CrashStealer infections.
xattr -cr DIRECTORYDetections
Resources
- Threat Hunting the macOS edition Megan Carney (Report)
- GrrCon 2018: Threat Hunting the macOS edition Megan Carney
- A new version of the MacSync macOS stealer targets crypto enthusiasts and developers
- Field Effect detects AMOS Stealer delivered via Cursor AI agent session
- CrashStealer: C++ macOS infostealer posing as crash reporter
Acknowledgements
- Liran Ravich (Cribl) - clear-all (-c / -cr) use cases