Unsigned Kernel Extension Load Attempt

Status: experimental
Severity: critical
Log source: category kernel_extension, product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects attempts to load unsigned kernel extensions which may indicate rootkit installation or malicious kernel-level access

Known false positives

Legitimate unsigned kexts in development environments
Testing scenarios

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.006` Boot or Logon Autostart Execution: Kernel Modules and Extensions
Privilege Escalation	`T1547.006` Boot or Logon Autostart Execution: Kernel Modules and Extensions

Telemetry coverage

Platform	Record / event type
macOS	ESF event `kextload` (NOTIFY): Fires after the kernel successfully loads a kernel extension.
macOS	ESF event `kextunload` (NOTIFY): Fires after a kernel extension is successfully unloaded from the kernel.

Rule body

title: Unsigned Kernel Extension Load Attempt
id: 7e7a1a47-45dd-4f97-8205-1d6aea67f682
status: experimental
description: Detects attempts to load unsigned kernel extensions which may indicate
  rootkit installation or malicious kernel-level access
references:
- https://attack.mitre.org/techniques/T1547/006/
- https://objective-see.com/blog/blog_0x4B.html
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1547.006
logsource:
  product: macos
  service: endpointsecurity
  category: kernel_extension
detection:
  selection:
    esf.event_type: 17
    event.action: kextload
  filter_signed:
    TeamID: '*'
  condition: selection and not filter_signed
falsepositives:
- Legitimate unsigned kexts in development environments
- Testing scenarios
level: critical
modified: 2025/01/15

Stages and Predicates

Stage 0: `condition`

selection and not filter_signed

Stage 1: `selection`

selection:
  esf.event_type: 17
  event.action: kextload

Stage 2: `not filter_signed`

filter_signed:
  TeamID: '*'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TeamID`	wildcard	`*`	`excludes:TeamID` `field:"TeamID" value:"*"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`esf.event_type`	eq	`17`	`field:"esf.event_type" kind:eq value:"17"`
`event.action`	eq	`kextload`	`field:"EventType" kind:eq value:"kextload"`