osquery-defense-kit/kernel/unexpected-kernel-extensions.sql

SELECT
  *
FROM
  kernel_extensions
WHERE
  path NOT LIKE "/System/Library/Extensions/%"
  AND NOT (
    idx = 0
    AND name = "__kernel__"
  );