Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1564.014_extended-attributes
Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection.
Passed 19 of 22 test cases with the skill, and 16 of 22 without it.
and 1 more in the full report
3 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Under which MITRE ATT&CK tactics matrix phase and technique ID does hiding data in xattrs belong?
| Checked | Without skill | With skill |
|---|---|---|
| Categorizes the technique under Defense Evasion (TA0005). | Passed | Passed |
| Provides sub-technique ID T1564.014. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1564
Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like Finder, ls, or cat and require utilities such as xattr (macOS) or getfattr (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as user. (user permissions), trusted. (root permissions), security., and system., each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with com.apple.* (e.g., com.apple.quarantine, com.apple.metadata:_kMDItemUserTags) and used by system features like Gatekeeper and Spotlight.
An adversary may leverage xattrs by embedding a second-stage payload into the extended attribute of a legitimate file. On macOS, a payload can be embedded into a custom attribute using the xattr command. A separate loader can retrieve the attribute with xattr -p, decode the content, and execute it using a scripting interpreter. On Linux, an adversary may use setfattr to write a payload into the user. namespace of a legitimate file. A loader script can later extract the payload with getfattr --only-values, decode it, and execute it using bash or another interpreter. In both cases, because the primary file content remains unchanged, security tools and integrity checks that do not inspect extended attributes will observe the original file hash, allowing the malicious payload to evade detection.
Platforms: Linux, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Extended Attributes by examining the target platforms (Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1564.014 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.