Resource Forking
Subtechnique · ATTACK:enterprise:T1564.009
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1564.009",
"title": "Resource Forking",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1564/009",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b22e5153-ac28-4cc6-865c-2054e36285cb",
"external_id": "T1564.009",
"domain": "enterprise",
"created": "2021-10-12T20:02:31.866Z",
"modified": "2026-05-12T15:12:00.708Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "tau bundlore erika noerenberg 2020",
"url": "https://blogs.vmware.com/security/2020/06/tau-threat-analysis-bundlore-macos-mm-install-macos.html"
},
{
"source_name": "Resource and Data Forks",
"url": "https://flylib.com/books/en/4.395.1.192/1/"
},
{
"source_name": "ELC Extended Attributes",
"url": "https://eclecticlight.co/2020/10/24/theres-more-to-files-than-data-extended-attributes/"
},
{
"source_name": "sentinellabs resource named fork 2020",
"url": "https://www.sentinelone.com/labs/resourceful-macos-malware-hides-in-named-fork/"
},
{
"source_name": "macOS Hierarchical File System Overview",
"url": "http://tenon.com/products/codebuilder/User_Guide/6_File_Systems.html#anchor520553"
}
]
}Explicit source assertions (4)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1564.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4efc1b5d-c1cb-4d94-a4b8-6b0b2b857788
OSX Keydnap malwareATTACK:enterprise:T1564.009 → subtechnique-of → ATTACK:enterprise:T1564
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f7a4f3f-44ee-491f-be50-caa928214111
ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--950fca51-66e4-43c6-9af0-839e962b8409
tau bundlore erika noerenberg 2020 · sentinellabs resource named fork 2020ATTACK:enterprise:M1013 → mitigates → ATTACK:enterprise:T1564.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da7b2203-dade-4ec0-85a5-dada9409ae2f
Apple App Security Overview