Detection rules › Sigma
Unsigned Kernel Extension Load Attempt
Detects attempts to load unsigned kernel extensions which may indicate rootkit installation or malicious kernel-level access
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions |
| Privilege Escalation | T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions |
Rule body yaml
title: Unsigned Kernel Extension Load Attempt
id: 7e7a1a47-45dd-4f97-8205-1d6aea67f682
status: experimental
description: Detects attempts to load unsigned kernel extensions which may indicate
rootkit installation or malicious kernel-level access
references:
- https://attack.mitre.org/techniques/T1547/006/
- https://objective-see.com/blog/blog_0x4B.html
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1547.006
logsource:
product: macos
service: endpointsecurity
category: kernel_extension
detection:
selection:
esf.event_type: 17
event.action: kextload
filter_signed:
TeamID: '*'
condition: selection and not filter_signed
falsepositives:
- Legitimate unsigned kexts in development environments
- Testing scenarios
level: critical
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selection and not filter_signedStage 1: selection
selection:
esf.event_type: 17
event.action: kextload
Stage 2: not filter_signed
filter_signed:
TeamID: '*'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
TeamID | wildcard | * |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
esf.event_type | eq |
|
event.action | eq |
|