type: attack-pattern
spec_version: 2.1
id: attack-pattern--b22e5153-ac28-4cc6-865c-2054e36285cb
created: 2021-10-12T20:02:31.866Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1564/009
external_id: T1564.009
source_name: tau bundlore erika noerenberg 2020
description: Erika Noerenberg. (2020, June 29). TAU Threat Analysis: Bundlore (macOS) mm-install-macos. Retrieved October 12, 2021.
url: https://blogs.vmware.com/security/2020/06/tau-threat-analysis-bundlore-macos-mm-install-macos.html
source_name: Resource and Data Forks
description: Flylib. (n.d.). Identifying Resource and Data Forks. Retrieved October 12, 2021.
url: https://flylib.com/books/en/4.395.1.192/1/
source_name: ELC Extended Attributes
description: Howard Oakley. (2020, October 24). There's more to files than data: Extended Attributes. Retrieved October 12, 2021.
url: https://eclecticlight.co/2020/10/24/theres-more-to-files-than-data-extended-attributes/
source_name: sentinellabs resource named fork 2020
description: Phil Stokes. (2020, November 5). Resourceful macOS Malware Hides in Named Fork. Retrieved October 12, 2021.
url: https://www.sentinelone.com/labs/resourceful-macos-malware-hides-in-named-fork/
source_name: macOS Hierarchical File System Overview
description: Tenon. (n.d.). Retrieved October 12, 2021.
url: http://tenon.com/products/codebuilder/User_Guide/6_File_Systems.html#anchor520553
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:14.736Z
name: Resource Forking
description: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)

Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Jaron Bradley @jbradley89
Ivan Sinyakov
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_version: 1.1