chattr

Change attributes of files or directories. tldr-pages

GTFOBins privilege-escalation 1 Sigma rule name it 1 documented command

How chattr is abused

documented by GTFOBins

privilege-escalation

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for chattr.

1 documented command

from GTFOBins, each read by the identifier

privilege-escalation with sudo, as SUID

Make the target file immutable.

chattr +i /path/to/input-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for chattr. The identifier reads the line that runs chattr.

What detects it

Sigma process creation rules

mediumRemove Immutable File AttributeNasreddine Bencherchali (Nextron Systems)

Everyday use

from tldr-pages, CC BY 4.0

Make a file or directory immutable to changes and deletion, even by superuser

sudo chattr +i path/to/file_or_directoryIdentify

Make a file or directory mutable

sudo chattr -i path/to/file_or_directoryIdentify

Trips 1 Sigma rule: mediumRemove Immutable File Attribute by Nasreddine Bencherchali (Nextron Systems)

Recursively make an entire directory and contents immutable

sudo chattr -R +i path/to/directoryIdentify

-RRecurse toybox

Of the 3 examples the identifier reads, 1 matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

3 in toybox

Show every option of chattr

-RRecurse

-p PROJIDSet the file's project number

-v VERSIONSet the file's version/generation number