Resource Forking
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
DET0584's single analytic, AN1609, offers exactly three log sources and all three are macos:unifiedlog: file creation/modification carrying a com.apple.ResourceFork extended attribute, execution of commands like ls -l@/xattr -l that inspect resource forks, and process creation involving binaries that interact with resource-fork data. No rule anywhere in this corpus selects on macos/unifiedlog fields -- every prior brief offering only that source has declined for the same reason, most recently T1553.001 -- and AUTHORING.md rule 2 forbids inventing field names to close the gap. […]
What the technique is
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code. Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder. Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1609
Unexpected creation or modification of files with com.apple.ResourceFork extended attributes containing unusually large or non-standard data. Defender perspective: detection of resource forks in contexts where they are uncommon, especially when paired with process execution or network activity.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.