tfMITRE ATT&CK sub-technique

Resource Forking T1564.009

Tactic: Stealth
Platform: macOS
Version: 2.0
Created: 12 October 2021
Last modified: 12 May 2026
Contributors: Ivan Sinyakov; Jaron Bradley @jbradley89

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.[1] Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.[2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Resource Forking MITRE reference T1564.009

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

OSX/ShlayerS0402 ↗

Has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.1 2

created 2019-08-29MALWARE

KeydnapS0276 ↗

Uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.1

created 2018-10-17MALWARE

All 2 software entries for this technique

Offense vs defense T1564.009

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Resource Forking detection strategy DET0584

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Resource Forking on macOS

Enterprise

1 platform

AN1609 · macOS

Unexpected creation or modification of files with com.apple.ResourceFork extended attributes containing unusually large or non-standard data. Defender perspective: detection of resource forks in contexts where they are uncommon, especially when paired with process execution or network activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process creation involving binaries interacting with resource fork data
File MetadataDC0059	macos:unifiedlog	File creation or modification with com.apple.ResourceFork extended attribute
Command ExecutionDC0064	macos:unifiedlog	Execution of commands like `ls -l@`, `xattr -l`, or custom tools interacting with resource forks

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ResourceForkSizeThreshold	Adjust thresholds for 'unusually large' resource fork data based on baseline usage in the environment.
MonitoredDirectories	Scope monitoring to sensitive directories such as /Users, /Applications, or temporary paths.
CorrelatedActivityWindow	Time window for correlating resource fork activity with subsequent execution or network activity.

Application Developer GuidanceM1013

Configure applications to use the application bundle structure which leverages the /Resources folder location.

Resource Forking detections T1564.009

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs