Display and manipulate extended attributes.
xattrxattrSandbox: execFile · Timeout: 30s
security.execution.command security.defenseevasion.bypass Bypass Gatekeeper via xattr: Use xattr to remove quarantine extended attribute from a file.
xattr -d com.apple.quarantine FILEBypass Gatekeeper via xattr: Use xattr to remove quarantine extended attribute from multiple files or directories.
xattr -d -r com.apple.quarantine *| Type | Rule / Indicator |
|---|---|
| other | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml Gatekeeper Bypass via Xattr |
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/xattr_extended_attributes_activity Jamf Protect: Detect activity related to xattr and extended attributes |
The xattr command can be used to display, modify or remove the extended attributes of one or more files, including directories and symbolic links. Extended attributes are arbitrary metadata stored with a file, but separate from the filesystem attributes (such as modification time or file size). The metadata is often a null-terminated UTF-8 string, but can also be arbitrary binary data. xattr can be used to bypass Gatekeeper.