Detection rules › Sigma

Kernel Extension Loaded from Temporary Directory

Status
experimental
Severity
critical
Log source
product macos, category kernel_extension, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects kernel extensions loaded from temporary directories which is highly suspicious and may indicate malware

MITRE ATT&CK coverage

Rule body yaml

title: Kernel Extension Loaded from Temporary Directory
id: a65d0810-117a-487e-9ea3-50d754277d6e
status: experimental
description: Detects kernel extensions loaded from temporary directories which is
  highly suspicious and may indicate malware
references:
- https://attack.mitre.org/techniques/T1547/006/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.persistence
- attack.t1547.006
logsource:
  product: macos
  service: endpointsecurity
  category: kernel_extension
detection:
  selection:
    esf.event_type: 17
    event.action: kextload
    KextPath|contains:
    - /tmp/
    - /var/tmp/
    - /private/tmp/
    - /private/var/tmp/
    - /dev/shm/
  condition: selection
falsepositives:
- Very rare legitimate use cases
level: critical
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  esf.event_type: 17
  event.action: kextload
  KextPath|contains:
  - /tmp/
  - /var/tmp/
  - /private/tmp/
  - /private/var/tmp/
  - /dev/shm/

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
KextPathmatch
  • /dev/shm/
  • /private/tmp/
  • /private/var/tmp/
  • /tmp/
  • /var/tmp/
esf.event_typeeq
  • 17
event.actioneq
  • kextload