Detect CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation in Splunk
Detects exploitation attempts of CVE-2021-30952, an integer overflow vulnerability in Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Integer overflow conditions in Apple platform components can lead to memory corruption, arbitrary code execution, or privilege escalation.
MITRE ATT&CK
SPL Detection Query
index=endpoint sourcetype=jamf_protect OR sourcetype=crowdstrike_falcon OR sourcetype=carbon_black_defense
| where (os_type="macOS" OR os_type="iOS" OR device_type IN ("mac", "iphone", "ipad"))
| where (process_name IN ("WebContent", "com.apple.WebKit.WebContent", "MobileSafari", "Safari") OR parent_process_name IN ("WebContent", "com.apple.WebKit.WebContent", "MobileSafari"))
| eval risk_score=case(
like(process_cmdline, "%overflow%"), 80,
match(process_path, "(?i)(tmp|var/folders|Library/Caches)"), 75,
parent_process_name IN ("sh", "bash", "zsh", "python", "python3") AND NOT like(process_path, "/Applications/%"), 70,
1=1, 0
)
| where risk_score > 0
| stats count, max(risk_score) as max_risk, values(process_name) as processes, values(process_cmdline) as cmdlines by host, user, _time
| where count >= 1
| sort - max_riskIdentifies suspicious WebKit and Safari process activity on Apple devices that may indicate exploitation of CVE-2021-30952, including processes spawned from unexpected paths or with anomalous parent processes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate macOS software update processes touching WebKit components
- Enterprise MDM operations invoking Safari or WebKit on managed devices
- Security scanning tools performing vulnerability assessments on Apple devices
- Developer workflows running Safari Technology Preview or WebKit nightlies
Other platforms for CVE-2021-30952
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate WebKit Process Spawning Shell from Non-Standard Path
Expected signal: Process creation event showing /tmp/webkit-sim/WebContent spawning with process name matching WebContent but executing from /tmp path
- Test 2Create Persistence via LaunchAgent After Simulated WebKit Compromise
Expected signal: File creation event for plist in ~/Library/LaunchAgents/ followed by launchctl process execution loading the new agent
- Test 3Simulate Integer Overflow Memory Pressure via Safari Crash Report Generation
Expected signal: File creation event for .crash file in /tmp with WebContent prefix; potential file integrity monitoring alert
Unlock Pro Content
Get the full detection package for CVE-2021-30952 including response playbook, investigation guide, and atomic red team tests.