Detection rules › Sigma
Kernel Extension Loaded from Temporary Directory
Detects kernel extensions loaded from temporary directories which is highly suspicious and may indicate malware
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions |
Rule body yaml
title: Kernel Extension Loaded from Temporary Directory
id: a65d0810-117a-487e-9ea3-50d754277d6e
status: experimental
description: Detects kernel extensions loaded from temporary directories which is
highly suspicious and may indicate malware
references:
- https://attack.mitre.org/techniques/T1547/006/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.persistence
- attack.t1547.006
logsource:
product: macos
service: endpointsecurity
category: kernel_extension
detection:
selection:
esf.event_type: 17
event.action: kextload
KextPath|contains:
- /tmp/
- /var/tmp/
- /private/tmp/
- /private/var/tmp/
- /dev/shm/
condition: selection
falsepositives:
- Very rare legitimate use cases
level: critical
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type: 17
event.action: kextload
KextPath|contains:
- /tmp/
- /var/tmp/
- /private/tmp/
- /private/var/tmp/
- /dev/shm/
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
KextPath | match |
|
esf.event_type | eq |
|
event.action | eq |
|