T1564.009 — Resource Forking

Tactic: Stealth · Platforms: macOS

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code. Usage of a resource…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (1)

T1564.009 Hide Artifacts: Resource Forking

title: "T1564.009 Hide Artifacts: Resource Forking"
id: a051f867-209c-4ec7-acf0-17915ee33be2
description: 'Detection Strategy for Resource Forking on macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ResourceForkSizeThreshold, MonitoredDirectories, CorrelatedActivityWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/009
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.stealth
  - attack.t1564.009

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/cp'
      - '/ditto'
    CommandLine|contains: '--rsrc'

  condition: selection

falsepositives:
  - Legacy classic Mac OS format conversion tools and some archive utilities that legitimately preserve resource forks when copying files to non-native file systems.

level: low

Related sub-techniques

Explore