Detection rules › Sigma

Suspicious Kernel Extension Names

Status
experimental
Severity
high
Log source
product macos, category kernel_extension, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects kernel extensions with suspicious or generic names often used by rootkits and malware

MITRE ATT&CK coverage

TacticTechniques
StealthT1014 Rootkit

Rule body yaml

title: Suspicious Kernel Extension Names
id: 8aa8d6c9-61fc-46ac-b83f-f055cb640186
status: experimental
description: Detects kernel extensions with suspicious or generic names often used
  by rootkits and malware
references:
- https://attack.mitre.org/techniques/T1014/
- https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.defense_evasion
- attack.t1014
logsource:
  product: macos
  service: endpointsecurity
  category: kernel_extension
detection:
  selection:
    esf.event_type: 17
    event.action: kextload
    KextIdentifier|contains:
    - rootkit
    - backdoor
    - keylogger
    - stealth
    - hidden
    - fake
    - com.test.
    - com.temp.
  condition: selection
falsepositives:
- Development and testing kexts
level: high
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  esf.event_type: 17
  event.action: kextload
  KextIdentifier|contains:
  - rootkit
  - backdoor
  - keylogger
  - stealth
  - hidden
  - fake
  - com.test.
  - com.temp.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
KextIdentifiermatch
  • backdoor
  • com.temp.
  • com.test.
  • fake
  • hidden
  • keylogger
  • rootkit
  • stealth
esf.event_typeeq
  • 17
event.actioneq
  • kextload