Wait until your learn about Alternate Data Streams…
They had their use when running Services for Macintosh.
Decent writeup from CS with that evasion method described -
https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spid...
They had their use when running Services for Macintosh.