Detect CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation in Microsoft Sentinel
Detects exploitation attempts of CVE-2021-30952, an integer overflow vulnerability in Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Integer overflow conditions in Apple platform components can lead to memory corruption, arbitrary code execution, or privilege escalation.
MITRE ATT&CK
KQL Detection Query
let lookback = 7d;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where DeviceType in ("MacOS", "iOS", "iPad")
| where (FileName in~ ("WebKit", "Safari", "MobileSafari", "com.apple.WebKit") or ProcessCommandLine has_any ("webkit", "JavaScriptCore", "WebCore"))
| where InitiatingProcessFileName !in~ ("softwareupdated", "mdmclient", "installd")
| extend RiskIndicator = case(
ProcessCommandLine has_any ("overflow", "heap spray", "shellcode"), "SuspiciousCommandArgs",
InitiatingProcessFileName has_any ("sh", "bash", "zsh") and FolderPath !startswith "/Applications", "ShellFromUnexpectedPath",
FileName has "crash" or ProcessCommandLine has "crash", "CrashIndicator",
"Unknown"
)
| where RiskIndicator != "Unknown"
| project Timestamp, DeviceName, DeviceType, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, RiskIndicator
| order by Timestamp descDetects suspicious process behaviors on Apple devices consistent with CVE-2021-30952 integer overflow exploitation, focusing on WebKit and related Apple framework processes spawning unexpected child processes or exhibiting crash-like behavior.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Safari or WebKit updates being applied via software update mechanisms
- Developer testing environments running WebKit debug builds
- Security research tools performing WebKit fuzzing or vulnerability testing
- Crash reporter processes legitimately collecting diagnostic information
Other platforms for CVE-2021-30952
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate WebKit Process Spawning Shell from Non-Standard Path
Expected signal: Process creation event showing /tmp/webkit-sim/WebContent spawning with process name matching WebContent but executing from /tmp path
- Test 2Create Persistence via LaunchAgent After Simulated WebKit Compromise
Expected signal: File creation event for plist in ~/Library/LaunchAgents/ followed by launchctl process execution loading the new agent
- Test 3Simulate Integer Overflow Memory Pressure via Safari Crash Report Generation
Expected signal: File creation event for .crash file in /tmp with WebContent prefix; potential file integrity monitoring alert
Response Playbook
Triage
- Identify the affected Apple device (macOS, iOS, iPadOS) and confirm the OS version against Apple's patched release notes for CVE-2021-30952 (HT212975–HT212982).
- Determine if the device is unpatched by checking the installed OS version against the minimum patched versions published in Apple's security advisories.
- Review process tree for the triggering WebKit or Safari process: identify parent process, child processes, and any network connections established around the same time.
- Check if the affected device has had any recent privilege escalation events, new user account creation, or persistence mechanisms (launch agents/daemons) added in the 24 hours surrounding the alert.
Containment
- Isolate the affected Apple device from the network via MDM (Jamf, Microsoft Intune, or equivalent) to prevent lateral movement or data exfiltration while investigation proceeds.
- Force an immediate OS update to the patched version via MDM or direct user instruction, prioritizing devices confirmed to be running vulnerable versions.
Evidence Collection
- Collect a full process listing, launch agent/daemon inventory, and crash reporter logs from the affected device using your EDR tool or Jamf Pro diagnostic collection.
- Export Safari and WebKit crash logs from ~/Library/Logs/DiagnosticReports/ and /Library/Logs/DiagnosticReports/ to preserve evidence of potential exploitation attempts.
Escalation Criteria
- !Escalate immediately if post-exploitation indicators are confirmed: new privileged user accounts, modified sudoers, persistence in launch agents, or outbound C2 connections from WebKit processes.
- !Escalate if multiple devices in the same network segment trigger this detection within a short time window, indicating potential targeted campaign or worm-like propagation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Apple Crash Reporter logs in ~/Library/Logs/DiagnosticReports/ containing WebContent or Safari crash entries with memory corruption indicators - >
LaunchAgent plist files in ~/Library/LaunchAgents/ or /Library/LaunchAgents/ created after the exploitation window - >
Unified Log entries (via log collect or Console.app) from the com.apple.webkit subsystem showing unexpected error conditions
Tuning Guidance
This detection generates moderate noise on macOS enterprise environments with custom app deployments. Tune by building an allowlist of known-good process paths and parent-child relationships specific to your environment (e.g., enterprise apps embedding WebKit from custom directories). Increase confidence by correlating with network telemetry showing unusual outbound connections from WebKit processes. For iOS/iPadOS, telemetry is sparse — focus hunting on MDM enrollment anomalies and unusual app installations following exploitation windows.
Hunting Queries
Broad 30-day hunt for any non-standard child processes spawned by WebKit or Safari on macOS endpoints, designed to surface historical exploitation attempts that may have evaded real-time detection.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where DeviceType in ("MacOS")
| where InitiatingProcessFileName in~ ("com.apple.WebKit.WebContent", "WebContent", "Safari")
| where FileName !in~ ("com.apple.WebKit.Networking", "com.apple.WebKit.GPU", "SafariCloudHistoryPushAgent", "com.apple.Safari.SafeBrowsing.Service")
| where FolderPath !startswith "/Applications/"
| where FolderPath !startswith "/System/"
| summarize count(), make_set(FileName), make_set(FolderPath) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where count_ > 2index=endpoint sourcetype=jamf_protect earliest=-30d
| where parent_process_name IN ("com.apple.WebKit.WebContent", "WebContent", "Safari")
| where NOT (process_path LIKE "/Applications/%" OR process_path LIKE "/System/%" OR process_path LIKE "/usr/%")
| stats count, dc(process_name) as unique_procs, values(process_name) as proc_names by host, parent_process_name, _time
| where count > 1
| sort - countAtomic Red Team Tests
Simulates post-exploitation behavior where a compromised WebKit process spawns a shell process from a non-standard directory, mimicking code execution after an integer overflow exploit.
Command
mkdir -p /tmp/webkit-sim && cp /bin/sh /tmp/webkit-sim/WebContent && /tmp/webkit-sim/WebContent -c 'id; whoami; uname -a'Cleanup
rm -rf /tmp/webkit-simExpected Telemetry
Process creation event showing /tmp/webkit-sim/WebContent spawning with process name matching WebContent but executing from /tmp path
Expected Detection
Alert fires on process executing from /tmp with name matching WebKit process names outside standard Apple application directories
Simulates an attacker installing a LaunchAgent persistence mechanism following WebKit exploitation, a common post-exploitation step on macOS.
Command
cat > ~/Library/LaunchAgents/com.test.cve2021.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict><key>Label</key><string>com.test.cve2021</string><key>ProgramArguments</key><array><string>/bin/sh</string><string>-c</string><string>echo pwned > /tmp/cve2021_test.txt</string></array><key>RunAtLoad</key><true/></dict></plist>
EOF
launchctl load ~/Library/LaunchAgents/com.test.cve2021.plistCleanup
launchctl unload ~/Library/LaunchAgents/com.test.cve2021.plist; rm ~/Library/LaunchAgents/com.test.cve2021.plist; rm -f /tmp/cve2021_test.txtExpected Telemetry
File creation event for plist in ~/Library/LaunchAgents/ followed by launchctl process execution loading the new agent
Expected Detection
EDR or file integrity monitoring alert on new LaunchAgent plist creation; complements CVE-2021-30952 detection by confirming post-exploitation persistence
Forces a crash report generation mimicking the diagnostic artifacts produced when an integer overflow triggers a crash in WebKit, useful for testing crash log collection and monitoring.
Command
python3 -c "
import subprocess, os, tempfile
crash_content = '''Process: WebContent [99999]
Identifier: com.apple.WebKit.WebContent
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS
Termination Reason: Namespace SIGNAL, Code 11 Segmentation fault: 11
Triggered by Thread: 0
CVE-2021-30952-test-artifact
'''
with tempfile.NamedTemporaryFile(mode='w', suffix='.crash', dir='/tmp', delete=False, prefix='WebContent_') as f:
f.write(crash_content)
print(f'Created simulated crash artifact: {f.name}')
"Cleanup
rm -f /tmp/WebContent_*.crashExpected Telemetry
File creation event for .crash file in /tmp with WebContent prefix; potential file integrity monitoring alert
Expected Detection
Log monitoring or file integrity tools detecting crash report artifacts referencing WebContent process with memory access violations, triggering investigation workflow