{
  "node_id": "mitre-attack-t1564-014-extended-attributes",
  "title": "MITRE ATT&CK T1564.014: Extended Attributes (Enterprise Tactic TA0005 - Stealth)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-06",
  "bluf": "MITRE ATT&CK T1564.014 (Extended Attributes) is an Enterprise Stealth technique. Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like `Finder`, `ls`, or `cat` and require utilities such as `xattr` (macOS) or `getfattr` (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as `user.` (user permissions), `trusted.` (root permissions), `security.`, and `system.`, each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with `com.apple.*` (e.g., `com.apple.quarantine`, `com.apple.m... Affected platforms: Linux, macOS. Sub-technique of ATT&CK T1564. ATT&CK-mapped mitigations: M1040 Behavior Prevention on Endpoint.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-framework-v14"
  ],
  "primary_citations_count": 5
}