Detection rules › Sigma
Suspicious Kernel Extension Names
Detects kernel extensions with suspicious or generic names often used by rootkits and malware
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1014 Rootkit |
Rule body yaml
title: Suspicious Kernel Extension Names
id: 8aa8d6c9-61fc-46ac-b83f-f055cb640186
status: experimental
description: Detects kernel extensions with suspicious or generic names often used
by rootkits and malware
references:
- https://attack.mitre.org/techniques/T1014/
- https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.defense_evasion
- attack.t1014
logsource:
product: macos
service: endpointsecurity
category: kernel_extension
detection:
selection:
esf.event_type: 17
event.action: kextload
KextIdentifier|contains:
- rootkit
- backdoor
- keylogger
- stealth
- hidden
- fake
- com.test.
- com.temp.
condition: selection
falsepositives:
- Development and testing kexts
level: high
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type: 17
event.action: kextload
KextIdentifier|contains:
- rootkit
- backdoor
- keylogger
- stealth
- hidden
- fake
- com.test.
- com.temp.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
KextIdentifier | match |
|
esf.event_type | eq |
|
event.action | eq |
|