Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes) Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Detection Strategy for Resource Forking on macOS
is blocked by Application Developer Guidance
is blocked by Resource Priority
is blocked by Secure Baseline Configurations
is blocked by Least Functionality
is blocked by User-Installed Software
is blocked by Continuous Monitoring
is blocked by Malicious Code Protection (Anti-Malware)
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Detonation Chambers (Sandboxes)
is blocked by Information In Shared Resources
is blocked by Information Output Filtering
is blocked by Developer Configuration Management
is blocked by Input Data Validation
Impressum Deutsch Englisch