kextstat is a macOS command-line utility that lists loaded kernel extensions. Attackers can use it to confirm whether a kernel extension is present, active, or hiding within a compromised system. Defenders monitor its use on endpoints that do not normally need it and compare loaded extensions against approved kernel extension inventory.
What kextstat Reveals About Loaded Kernel Extensions
kextstat is useful because it shows what kernel extensions are currently loaded, which can help defenders confirm whether a suspected extension is active and whether the system matches an approved baseline. On a compromised macOS host, that visibility also helps an attacker validate persistence or concealment.
Because kernel extensions run with high privilege in the operating system, the output is more than a convenience listing, it is a trust and integrity signal. If a kernel extension appears unexpectedly, or if a required extension is missing, the result can indicate tampering, shadow loading, or a mismatch between policy and reality.
Why kextstat Matters in macOS Defence
In practice, kextstat is most valuable where kernel extensions should be tightly controlled or rare. Security teams use it to compare what is loaded against an approved inventory, then investigate anything that should not be present on that endpoint class. That makes it especially relevant for fleet baselining, incident triage, and post-compromise verification.
It also matters because the command reflects runtime state, not just configuration intent. A package may be installed without being loaded, and a loaded extension may have arrived through legitimate administration, a vendor installer, or an attacker with local execution. The security meaning comes from pairing the output with endpoint role, expected software, and change records.
For broader living-off-the-land context, the same defensive mindset applies to other dual-use native utilities, and Living off the Land Guide covers how these tools are abused and monitored.
How Attackers and Defenders Use the Output
Attackers value kextstat because it helps them answer a simple question: did my kernel-level component load, and can I infer what security tooling is present? That makes it useful after a successful foothold, when local visibility helps them check for defensive drivers, suspicious extension names, or signs that a malicious component is still resident.
Defenders use the same output in reverse. They look for unexpected third-party extensions, unusual load timing, or endpoints that should never need kernel extension activity at all. On those systems, a loaded extension can be a high-signal finding, especially when combined with process, file, and boot-time telemetry.
That dual-use pattern is part of a wider macOS intrusion story. When malware or an agent tries to blend into normal activity, the defender often needs to reconcile runtime observations with expected platform behavior, not just rely on installed-software inventories.
Reading kextstat in Context
kextstat should not be treated as a standalone verdict. A loaded kernel extension may be legitimate, temporarily loaded during maintenance, or left behind by outdated software. The practical question is whether the extension is expected for that host, signed and approved for that environment, and consistent with the organisation’s hardening posture.
Where a host is supposed to be extension-free, any loaded kernel extension deserves review. Where extensions are permitted, the focus shifts to provenance, change control, and whether the loaded module matches the known-good list. In both cases, the command is most useful when paired with endpoint inventory, configuration management, and alerting on deviations from normal behavior.
For defenders tracking macOS abuse and agent-related compromise patterns, Meta Muse agent hijack 2026 is a useful reminder that local compromise can expose authentication material and extend attacker control beyond the original process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | Kernel extension abuse is commonly tied to gaining or maintaining elevated system control. |
| Recommendation — Map suspicious kernel-extension activity to privilege-escalation behavior and hunt for follow-on system control. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | kextstat supports runtime monitoring for unexpected loaded extensions on macOS endpoints. |
| Recommendation — Monitor endpoint runtime state for unexpected loaded kernel extensions and alert on deviations from baseline. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Unexpected kernel extensions can indicate malicious persistence or defence evasion on endpoints. |
| Recommendation — Use malware-defence controls to flag and investigate suspicious kernel extensions on macOS hosts. | ||
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | Loaded extensions should be reconciled against an authoritative inventory of approved system components. |
| SI-4 — System Monitoring | Runtime extension visibility is a monitoring signal for detecting hostile or unexpected kernel activity. | |
| Recommendation — Maintain an approved component inventory and compare loaded kernel extensions against it. Correlate kextstat findings with system monitoring to detect unusual kernel-extension loading. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org