CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability Exploitation

let AppleProcesses = dynamic(['Safari', 'WebKit', 'MobileSafari', 'com.apple.WebKit', 'com.apple.webkit']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where (FileName in~ (AppleProcesses) or ProcessCommandLine has_any (AppleProcesses))
| where InitiatingProcessFileName !in~ ('launchd', 'xpc', 'com.apple.launchd')
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(7d)
    | where RemotePort in (80, 443, 8080, 8443)
    | where InitiatingProcessFileName in~ (AppleProcesses)
) on DeviceId, InitiatingProcessFileName
| union (
    DeviceEvents
    | where TimeGenerated >= ago(7d)
    | where ActionType == "ProcessCrashed"
    | where FileName in~ (AppleProcesses)
)
| project TimeGenerated, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc

index=endpoint sourcetype=crowdstrike:events OR sourcetype=jamf:events OR sourcetype=mac_os:security
| eval apple_process=if(match(process_name, "(?i)(safari|webkit|mobilesafari|com\.apple\.webkit)"), 1, 0)
| where apple_process=1
| eval suspicious=if(match(parent_process_name, "(?i)(bash|zsh|sh|python|perl|ruby|curl|wget)"), 1, 0)
| eval crash_event=if(match(event_type, "(?i)(crash|exception|segfault|signal)"), 1, 0)
| where suspicious=1 OR crash_event=1
| stats count by _time, host, user, process_name, parent_process_name, event_type, dest_ip, dest_port
| eval risk_score=case(suspicious=1 AND crash_event=1, 90, suspicious=1, 70, crash_event=1, 50, true(), 30)
| where risk_score >= 50
| sort -risk_score, -_time

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name : ("Safari", "com.apple.WebKit*", "WebKitWebProcess")
    and not process.parent.name : ("launchd", "Finder", "Dock")]
  [any where event.category : ("network", "process")
    and (
      (event.category == "network" and network.direction == "egress" and destination.port in (80, 443, 4444, 8080, 8443))
      or
      (event.category == "process" and process.name : ("bash", "zsh", "sh", "python*", "ruby", "perl"))
    )
  ]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  "Process Name",
  "Parent Process Name",
  destinationip,
  destinationport
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apple macOS', 'CrowdStrike Falcon', 'Carbon Black')
  AND (
    LOWER("Process Name") LIKE '%safari%'
    OR LOWER("Process Name") LIKE '%webkit%'
    OR LOWER("Process Name") LIKE '%webkitwebprocess%'
  )
  AND (
    LOWER("Parent Process Name") IN ('bash', 'zsh', 'sh', 'python', 'python3', 'ruby', 'perl', 'curl', 'wget')
    OR destinationport IN (4444, 1337, 31337, 8888)
  )
  AND DATEFORMAT(devicetime, 'yyyy-MM-dd') >= DATEADD('day', -7, CURRENT_DATE)
ORDER BY devicetime DESC
LIMIT 1000

_sourceCategory=endpoint/macos OR _sourceCategory=endpoint/crowdstrike
| json auto
| where (%"process.name" matches /(?i)(safari|webkit|webkitwebprocess|com\.apple\.webkit)/
  OR process_name matches /(?i)(safari|webkit|webkitwebprocess)/)
| where (%"parent.process.name" matches /(?i)(bash|zsh|sh|python|ruby|perl|curl|wget)/
  OR parent_process_name matches /(?i)(bash|zsh|sh|python|ruby|perl|curl|wget)/
  OR %"event.type" = "crash"
  OR event_type = "crash")
| timeslice 1h
| stats count as event_count, first(%"host.name") as hostname, first(%"user.name") as username,
  first(%"process.name") as proc_name, first(%"parent.process.name") as parent_proc by _timeslice
| where event_count > 0
| sort by _timeslice desc

rule cve_2022_48503_apple_exploitation {
  meta:
    author = "df00tech"
    description = "Detects potential CVE-2022-48503 exploitation via Apple product process anomalies"
    severity = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-48503"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(safari|webkit|webkitwebprocess)/
    (
      $proc.principal.process.parent_process.file.full_path = /(?i)(bash|zsh|\/bin\/sh|python|ruby|perl|curl|wget)/
      or $proc.target.process.file.full_path = /(?i)(bash|zsh|\/bin\/sh|python|ruby|perl)/
    )

  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ProcessImageFileName=/(?i)(safari|webkit|webkitwebprocess)/i
| ParentProcessImageFileName=/(?i)(bash|zsh|\/bin\/sh|python3?|ruby|perl|curl|wget)/i
| table([_time, ComputerName, UserName, ProcessImageFileName, CommandLine, ParentProcessImageFileName, ParentCommandLine, RemoteIP, RemotePort])
| sort(_time, order=desc)
| limit 500