Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1564.009_resource-forking
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.
Passed 21 of 22 test cases with the skill, and 17 of 22 without it.
and 2 more in the full report
5 fixed16 passed either way0 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a formal risk matrix for macOS endpoints, what primary impact category is listed alongside the severity finding for resource fork abuse?
| Checked | Without skill | With skill |
|---|---|---|
| Lists Defense Evasion as the primary impact. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1564
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code. Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.
Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.
Platforms: macOS
Identify Attack Surface: Determine if the target environment is susceptible to Resource Forking by examining the target platforms (macOS).
Assess Existing Defenses: Review whether mitigations for T1564.009 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Configure applications to use the application bundle structure which leverages the /Resources folder location.
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.