Which SIEM platforms have a CVE-2021-30952 detection rule?

df00tech provides CVE-2021-30952 (CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2021-30952 detection?

The CVE-2021-30952 detection is rated high severity with medium confidence.

What are common false positives for CVE-2021-30952?

Common false positives for CVE-2021-30952 include: Legitimate Safari or WebKit updates being applied via software update mechanisms; Developer testing environments running WebKit debug builds; Security research tools performing WebKit fuzzing or vulnerability testing.

CVE-2021-30952 IBM QRadar · QRadar

Detect CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation in IBM QRadar

Q: What data sources are required to detect CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation (CVE-2021-30952)?

Detecting CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation requires the following data sources: Microsoft Defender for Endpoint, Microsoft Sentinel.

Detects exploitation attempts of CVE-2021-30952, an integer overflow vulnerability in Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Integer overflow conditions in Apple platform components can lead to memory corruption, arbitrary code execution, or privilege escalation.

MITRE ATT&CK

Tactic: Execution Privilege Escalation Initial Access

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "processname",
  "parentprocessname",
  "filename",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apple macOS', 'CrowdStrike Falcon', 'Carbon Black')
  AND (
    "processname" ILIKE '%WebContent%'
    OR "processname" ILIKE '%WebKit%'
    OR "processname" ILIKE '%MobileSafari%'
    OR "processname" ILIKE '%Safari%'
  )
  AND "parentprocessname" NOT ILIKE '%launchd%'
  AND "parentprocessname" NOT ILIKE '%softwareupdated%'
  AND "filename" NOT ILIKE '/Applications/%'
  AND "filename" NOT ILIKE '/System/%'
  AND LOGSOURCESTARTTIME(logsourceid) > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

high severity low confidence

QRadar AQL query identifying WebKit and Safari processes exhibiting anomalous behavior on Apple endpoints, including processes running from non-standard paths or spawned by unexpected parent processes.

Data Sources

QRadar SIEMCrowdStrike Falcon via QRadar DSMCarbon Black via QRadar DSM

Required Tables

events

False Positives & Tuning

Legitimate Apple system processes performing background WebKit rendering tasks
Enterprise endpoint management tools interacting with Safari configuration
Security audit tools generating process telemetry on macOS endpoints

Other platforms for CVE-2021-30952

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate WebKit Process Spawning Shell from Non-Standard Path
Expected signal: Process creation event showing /tmp/webkit-sim/WebContent spawning with process name matching WebContent but executing from /tmp path
Test 2Create Persistence via LaunchAgent After Simulated WebKit Compromise
Expected signal: File creation event for plist in ~/Library/LaunchAgents/ followed by launchctl process execution loading the new agent
Test 3Simulate Integer Overflow Memory Pressure via Safari Crash Report Generation
Expected signal: File creation event for .crash file in /tmp with WebContent prefix; potential file integrity monitoring alert

Last updated: 2026-06-19 Research depth: standard

References (6)

Response Playbook

Triage

Identify the affected Apple device (macOS, iOS, iPadOS) and confirm the OS version against Apple's patched release notes for CVE-2021-30952 (HT212975–HT212982).
Determine if the device is unpatched by checking the installed OS version against the minimum patched versions published in Apple's security advisories.
Review process tree for the triggering WebKit or Safari process: identify parent process, child processes, and any network connections established around the same time.
Check if the affected device has had any recent privilege escalation events, new user account creation, or persistence mechanisms (launch agents/daemons) added in the 24 hours surrounding the alert.

Containment

Isolate the affected Apple device from the network via MDM (Jamf, Microsoft Intune, or equivalent) to prevent lateral movement or data exfiltration while investigation proceeds.
Force an immediate OS update to the patched version via MDM or direct user instruction, prioritizing devices confirmed to be running vulnerable versions.

Evidence Collection

Collect a full process listing, launch agent/daemon inventory, and crash reporter logs from the affected device using your EDR tool or Jamf Pro diagnostic collection.
Export Safari and WebKit crash logs from ~/Library/Logs/DiagnosticReports/ and /Library/Logs/DiagnosticReports/ to preserve evidence of potential exploitation attempts.

Escalation Criteria

!Escalate immediately if post-exploitation indicators are confirmed: new privileged user accounts, modified sudoers, persistence in launch agents, or outbound C2 connections from WebKit processes.
!Escalate if multiple devices in the same network segment trigger this detection within a short time window, indicating potential targeted campaign or worm-like propagation.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Apple Crash Reporter logs in ~/Library/Logs/DiagnosticReports/ containing WebContent or Safari crash entries with memory corruption indicators
>LaunchAgent plist files in ~/Library/LaunchAgents/ or /Library/LaunchAgents/ created after the exploitation window
>Unified Log entries (via log collect or Console.app) from the com.apple.webkit subsystem showing unexpected error conditions

Tuning Guidance

This detection generates moderate noise on macOS enterprise environments with custom app deployments. Tune by building an allowlist of known-good process paths and parent-child relationships specific to your environment (e.g., enterprise apps embedding WebKit from custom directories). Increase confidence by correlating with network telemetry showing unusual outbound connections from WebKit processes. For iOS/iPadOS, telemetry is sparse — focus hunting on MDM enrollment anomalies and unusual app installations following exploitation windows.

Hunting Queries

Broad 30-day hunt for any non-standard child processes spawned by WebKit or Safari on macOS endpoints, designed to surface historical exploitation attempts that may have evaded real-time detection.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(30d)
| where DeviceType in ("MacOS")
| where InitiatingProcessFileName in~ ("com.apple.WebKit.WebContent", "WebContent", "Safari")
| where FileName !in~ ("com.apple.WebKit.Networking", "com.apple.WebKit.GPU", "SafariCloudHistoryPushAgent", "com.apple.Safari.SafeBrowsing.Service")
| where FolderPath !startswith "/Applications/"
| where FolderPath !startswith "/System/"
| summarize count(), make_set(FileName), make_set(FolderPath) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where count_ > 2

Hunting — SPL

spl

index=endpoint sourcetype=jamf_protect earliest=-30d
| where parent_process_name IN ("com.apple.WebKit.WebContent", "WebContent", "Safari")
| where NOT (process_path LIKE "/Applications/%" OR process_path LIKE "/System/%" OR process_path LIKE "/usr/%")
| stats count, dc(process_name) as unique_procs, values(process_name) as proc_names by host, parent_process_name, _time
| where count > 1
| sort - count

Atomic Red Team Tests

Test 1 Simulate WebKit Process Spawning Shell from Non-Standard Path

macos

Simulates post-exploitation behavior where a compromised WebKit process spawns a shell process from a non-standard directory, mimicking code execution after an integer overflow exploit.

Command

bash

mkdir -p /tmp/webkit-sim && cp /bin/sh /tmp/webkit-sim/WebContent && /tmp/webkit-sim/WebContent -c 'id; whoami; uname -a'

Cleanup

bash

rm -rf /tmp/webkit-sim

Expected Telemetry

Process creation event showing /tmp/webkit-sim/WebContent spawning with process name matching WebContent but executing from /tmp path

Expected Detection

Alert fires on process executing from /tmp with name matching WebKit process names outside standard Apple application directories

Test 2 Create Persistence via LaunchAgent After Simulated WebKit Compromise

macos

Simulates an attacker installing a LaunchAgent persistence mechanism following WebKit exploitation, a common post-exploitation step on macOS.

Command

bash

cat > ~/Library/LaunchAgents/com.test.cve2021.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict><key>Label</key><string>com.test.cve2021</string><key>ProgramArguments</key><array><string>/bin/sh</string><string>-c</string><string>echo pwned > /tmp/cve2021_test.txt</string></array><key>RunAtLoad</key><true/></dict></plist>
EOF
launchctl load ~/Library/LaunchAgents/com.test.cve2021.plist

Cleanup

bash

launchctl unload ~/Library/LaunchAgents/com.test.cve2021.plist; rm ~/Library/LaunchAgents/com.test.cve2021.plist; rm -f /tmp/cve2021_test.txt

Expected Telemetry

File creation event for plist in ~/Library/LaunchAgents/ followed by launchctl process execution loading the new agent

Expected Detection

EDR or file integrity monitoring alert on new LaunchAgent plist creation; complements CVE-2021-30952 detection by confirming post-exploitation persistence

Test 3 Simulate Integer Overflow Memory Pressure via Safari Crash Report Generation

macos

Forces a crash report generation mimicking the diagnostic artifacts produced when an integer overflow triggers a crash in WebKit, useful for testing crash log collection and monitoring.

Command

bash

python3 -c "
import subprocess, os, tempfile
crash_content = '''Process: WebContent [99999]
Identifier: com.apple.WebKit.WebContent
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS
Termination Reason: Namespace SIGNAL, Code 11 Segmentation fault: 11
Triggered by Thread: 0
CVE-2021-30952-test-artifact
'''
with tempfile.NamedTemporaryFile(mode='w', suffix='.crash', dir='/tmp', delete=False, prefix='WebContent_') as f:
    f.write(crash_content)
    print(f'Created simulated crash artifact: {f.name}')
"

Cleanup

bash

rm -f /tmp/WebContent_*.crash

Expected Telemetry

File creation event for .crash file in /tmp with WebContent prefix; potential file integrity monitoring alert

Expected Detection

Log monitoring or file integrity tools detecting crash report artifacts referencing WebContent process with memory access violations, triggering investigation workflow

Related Detections

Tactic Hubs

TA0002Execution TA0004Privilege Escalation TA0001Initial Access

Related Techniques

T1203Exploitation for Client Execution T1068Exploitation for Privilege Escalation T1190Exploit Public-Facing Application

Detect CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2021-30952

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Execution

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2021-30952

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Execution

Popular Detections

Get new detections in your inbox