Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using <code>ls -l@</code> or <code>xattr -l</code> commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the <code>/Resources</code> folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)

Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
Resource Forking
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1564/009  external_id: T1564.009     source_name: tau bundlore erika noerenberg 2020  description: Erika Noerenberg. (2020, June 29). TAU Threat Analysis: Bundlore (macOS) mm-install-macos. Retrieved October 12, 2021.  url: https://blogs.vmware.com/security/2020/06/tau-threat-analysis-bundlore-macos-mm-install-macos.html     source_name: Resource and Data Forks  description: Flylib. (n.d.). Identifying Resource and Data Forks. Retrieved October 12, 2021.  url: https://flylib.com/books/en/4.395.1.192/1/     source_name: ELC Extended Attributes  description: Howard Oakley. (2020, October 24). There's more to files than data: Extended Attributes. Retrieved October 12, 2021.  url: https://eclecticlight.co/2020/10/24/theres-more-to-files-than-data-extended-attributes/     source_name: sentinellabs resource named fork 2020  description: Phil Stokes. (2020, November 5). Resourceful macOS Malware Hides in Named Fork. Retrieved October 12, 2021.  url: https://www.sentinelone.com/labs/resourceful-macos-malware-hides-in-named-fork/     source_name: macOS Hierarchical File System Overview  description: Tenon. (n.d.). Retrieved October 12, 2021.  url: http://tenon.com/products/codebuilder/User_Guide/6_File_Systems.html#anchor520553     