osquery-defense-kit/detection/evasion/unexpected-kernel-extensions-macos.sql
2023-02-09 17:54:41 -05:00

20 lines
549 B
SQL

-- Find unexpected 3rd-party kernel extensions
--
-- false positives:
-- * none known
--
-- platform: darwin
-- tags: persistent seldom kernel
SELECT
linked_against, name, path, size, version,
path || ',' || name || ',' || version || ',' || linked_against AS exception_key
FROM
kernel_extensions
WHERE
path NOT LIKE '/System/Library/Extensions/%'
AND NOT (
idx = 0
AND name = '__kernel__'
)
AND exception_key NOT IN ('/Library/StagedExtensions/Library/Extensions/CalDigitUSBHubSupport.kext,com.CalDigit.USBHubSupport,1,<3>')