CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation

let lookback = 7d;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where DeviceType in ("MacOS", "iOS", "iPad")
| where (FileName in~ ("WebKit", "Safari", "MobileSafari", "com.apple.WebKit") or ProcessCommandLine has_any ("webkit", "JavaScriptCore", "WebCore"))
| where InitiatingProcessFileName !in~ ("softwareupdated", "mdmclient", "installd")
| extend RiskIndicator = case(
    ProcessCommandLine has_any ("overflow", "heap spray", "shellcode"), "SuspiciousCommandArgs",
    InitiatingProcessFileName has_any ("sh", "bash", "zsh") and FolderPath !startswith "/Applications", "ShellFromUnexpectedPath",
    FileName has "crash" or ProcessCommandLine has "crash", "CrashIndicator",
    "Unknown"
  )
| where RiskIndicator != "Unknown"
| project Timestamp, DeviceName, DeviceType, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, RiskIndicator
| order by Timestamp desc

index=endpoint sourcetype=jamf_protect OR sourcetype=crowdstrike_falcon OR sourcetype=carbon_black_defense
| where (os_type="macOS" OR os_type="iOS" OR device_type IN ("mac", "iphone", "ipad"))
| where (process_name IN ("WebContent", "com.apple.WebKit.WebContent", "MobileSafari", "Safari") OR parent_process_name IN ("WebContent", "com.apple.WebKit.WebContent", "MobileSafari"))
| eval risk_score=case(
    like(process_cmdline, "%overflow%"), 80,
    match(process_path, "(?i)(tmp|var/folders|Library/Caches)"), 75,
    parent_process_name IN ("sh", "bash", "zsh", "python", "python3") AND NOT like(process_path, "/Applications/%"), 70,
    1=1, 0
  )
| where risk_score > 0
| stats count, max(risk_score) as max_risk, values(process_name) as processes, values(process_cmdline) as cmdlines by host, user, _time
| where count >= 1
| sort - max_risk

sequence by host.name, user.name with maxspan=5m
  [process where host.os.type == "macos"
   and process.name in ("com.apple.WebKit.WebContent", "WebContent", "Safari", "MobileSafari")
   and event.type == "start"]
  [process where host.os.type == "macos"
   and process.parent.name in ("com.apple.WebKit.WebContent", "WebContent", "Safari")
   and process.name not in ("com.apple.WebKit.Networking", "com.apple.WebKit.GPU", "SafariCloudHistoryPushAgent")
   and not process.executable : "/Applications/*"
   and not process.executable : "/System/*"
   and not process.executable : "/usr/bin/*"]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "processname",
  "parentprocessname",
  "filename",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apple macOS', 'CrowdStrike Falcon', 'Carbon Black')
  AND (
    "processname" ILIKE '%WebContent%'
    OR "processname" ILIKE '%WebKit%'
    OR "processname" ILIKE '%MobileSafari%'
    OR "processname" ILIKE '%Safari%'
  )
  AND "parentprocessname" NOT ILIKE '%launchd%'
  AND "parentprocessname" NOT ILIKE '%softwareupdated%'
  AND "filename" NOT ILIKE '/Applications/%'
  AND "filename" NOT ILIKE '/System/%'
  AND LOGSOURCESTARTTIME(logsourceid) > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=endpoint/macos OR _sourceCategory=crowdstrike/falcon
| json field=_raw "process_name", "parent_process_name", "process_path", "user", "hostname" nodrop
| where process_name in ("com.apple.WebKit.WebContent", "WebContent", "Safari", "MobileSafari") OR parent_process_name in ("com.apple.WebKit.WebContent", "WebContent")
| where !(process_path matches "/Applications/*") AND !(process_path matches "/System/*") AND !(process_path matches "/usr/*")
| where parent_process_name not in ("launchd", "softwareupdated", "mdmclient")
| eval risk = if(parent_process_name in ("sh", "bash", "zsh", "python3"), "HIGH", "MEDIUM")
| count by hostname, user, process_name, parent_process_name, process_path, risk
| sort by _count desc

rule cve_2021_30952_apple_integer_overflow {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2021-30952 Apple integer overflow vulnerability"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-30952"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.platform = "MAC"
    (
      $e.target.process.file.full_path = /\/com\.apple\.WebKit\.WebContent/ nocase or
      $e.target.process.file.full_path = /\/Safari/ nocase or
      $e.target.process.file.full_path = /\/MobileSafari/ nocase
    )
    not $e.target.process.file.full_path = /^\/Applications\// nocase
    not $e.target.process.file.full_path = /^\/System\// nocase
    not $e.principal.process.file.full_path = /^\/System\/Library\// nocase
    not $e.principal.process.file.full_path = /\/launchd/ nocase

  condition:
    $e
}

event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2)
| filter (FileName = "com.apple.WebKit.WebContent" OR FileName = "WebContent" OR FileName = "Safari" OR FileName = "MobileSafari")
| filter NOT (ImageFileName = "/Applications/*" OR ImageFileName = "/System/*" OR ImageFileName = "/usr/bin/*")
| filter ParentBaseFileName NOT IN ("launchd", "softwareupdated", "mdmclient", "installd")
| eval RiskLevel = case(
    ParentBaseFileName IN ("sh", "bash", "zsh", "python3", "python"), "HIGH",
    match(ImageFileName, "(?i)(tmp|var/folders|Library/Caches)"), "HIGH",
    true, "MEDIUM"
  )
| stats count() as ProcessCount, values(CommandLine) as CommandLines by DeviceName, UserName, FileName, ImageFileName, ParentBaseFileName, RiskLevel
| sort -ProcessCount