Elastic Defend high stable eql

New System Kext File and Immediate Load via KextLoad

Detects the use of the cp or mv binaries to add a kext file in the System extensions directory and then immediately load it via the kextload utility. Threat actors have created malicious kernel extensions and attempted to load them on compromised systems in order to bypass defences and manipulate their presence on the machine.

View Source

Detection Logic

sequence by process.parent.pid with maxspan=20s
[process where event.type == "start" and event.action == "exec" and 
    process.name in ("mv", "cp") and
    process.args like "/System/Library/Extensions/*.kext"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "kextload"]

Field Validations

Loading…

Comments (0)

Loading comments...