Techniques › T1547.006 › AN1244
AN1244 Analytic 1244
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detect user-initiated kextload commands or modifications to /Library/Extensions. Correlate with changes to KextPolicy database or unauthorized developer signing identities. Alert on attempts to disable SIP or load legacy extensions from unsigned sources.</p>
- Detects
- T1547.006 Kernel Modules and Extensions
- Part of
- DET0450 Detection Strategy for Kernel Modules and Extensions Autostart Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | kextload execution from Terminal or suspicious paths | DC0064 Command Execution |
| macos:osquery | Processes executing kextload, spctl, or modifying kernel extension directories | DC0032 Process Creation |
| macos:osquery | New kext entries not signed by Apple or outside standard identifier prefix | DC0031 Kernel Module Load |
| macos:osquery | Modifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DeveloperIDAllowlist | Approved developer IDs whose kexts should not trigger alerts |
KextLoadTimeWindow | Threshold for detecting kext loads outside standard install/update operations |
SignatureCheckFlag | Flag to enforce strict signing checks depending on SIP status |