CmdID

CmdID / Commands

xattr

Utility to work with extended filesystem attributes. tldr-pages

On macOS 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

List key:value extended attributes for a given file

xattr -l fileIdentify

Write an attribute for a given file

xattr -w attribute_key attribute_value fileIdentify

Delete an attribute from a given file

xattr -d com.apple.quarantine fileIdentify

Trips 1 Sigma rule: lowGatekeeper Bypass via Xattr by Daniil Yugoslavskiy, oscd.community

Delete all extended attributes from a given file

xattr -c fileIdentify

Recursively delete an attribute in a given directory

xattr -rd attribute_key directoryIdentify

What detects it

Sigma process creation rules that name xattr
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)
lowGatekeeper Bypass via XattrDaniil Yugoslavskiy, oscd.community