Kernel Extensions Info

Overview

Evidence: Kernel Extensions Info Description: Collect kernel extensions info Category: System Platform: macos Short Name: kext Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Kernel extensions (kexts) extend the macOS kernel with drivers and low-level components. This data is essential for detecting rootkits, unauthorized kernel modifications, and risky third‑party drivers.

Data Collected

This collector gathers structured data about kernel extensions info.

Kernel Extensions Info Data

Field	Description	Example
IDx	I Dx	123
Refs	Refs	123
MemorySize	Memory Size	123
Name	Name	Example value
Version	Version	Example value
LinkedAgainst	Linked Against	Example value
Path	Path	Example value
LastChangeTime	Last Change Time	2023-10-15 14:30:25+03:00
AccessTime	Access Time	2023-10-15 14:30:25+03:00
ModificationTime	Modification Time	2023-10-15 14:30:25+03:00
Hash	Hash	Example value
BinaryPath	Binary Path	Example value
SizeInBytes	Size In Bytes	123

Collection Method

This collector queries the kernel_extensions table via osquery and enriches results with file metadata and hashes.

Forensic Value

This evidence is crucial for forensic investigations as it surfaces loaded kernel extensions, enabling detection of persistence, unsigned drivers, and tampering with the kernel.