New System Kext File and Immediate Load via KextLoad


Description

Detects the use of the cp or mv binaries to add a kext file in the System extensions directory and then immediately load it via the kextload utility. Threat actors have created malicious kernel extensions and attempted to load them on compromised systems in order to bypass defences and manipulate their presence on the machine.

Query · eql

sequence by process.parent.pid with maxspan=20s
[process where event.type == "start" and event.action == "exec" and 
    process.name in ("mv", "cp") and
    process.args like "/System/Library/Extensions/*.kext"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "kextload"]
Raw source New System Kext File and Immediate Load via KextLoad · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Detects the use of the cp or mv binaries to add a kext file in the System extensions directory and then immediately load
it via the kextload utility. Threat actors have created malicious kernel extensions and attempted to load them on
compromised systems in order to bypass defences and manipulate their presence on the machine.
"""
id = "de869aa1-c63a-451e-a953-7069ec39ba60"
license = "Elastic License v2"
name = "New System Kext File and Immediate Load via KextLoad"
os_list = ["macos"]
version = "1.0.19"

query = '''
sequence by process.parent.pid with maxspan=20s
[process where event.type == "start" and event.action == "exec" and 
    process.name in ("mv", "cp") and
    process.args like "/System/Library/Extensions/*.kext"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "kextload"]
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.2"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.