macOS Resource Fork Used to Hide Payload Data

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic containing the string "/..namedfork/rsrc" (case-insensitive) over TCP to port 22 (SSH). This pattern is indicative of an attempt to use macOS resource forks to hide payload data, a technique often employed by malware for defense evasion. The detection specifically targets traffic originating from and destined for the home network, suggesting an internal system attempting to exfiltrate or receive hidden data.