Linux Extended Attribute Used to Hide Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the string "setfattr" in TCP traffic destined for port 22 (SSH). The presence of "setfattr" in SSH traffic might indicate an attempt to use Linux extended attributes to hide data or malicious payloads, a technique often associated with defense evasion.