Detect CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability Exploitation in Microsoft Sentinel
Detects potential exploitation of CVE-2022-48503, an unspecified vulnerability affecting Apple multiple products. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Detection focuses on suspicious process activity, network connections, and crash telemetry from Apple ecosystem processes that may indicate exploitation attempts.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let AppleProcesses = dynamic(['Safari', 'WebKit', 'MobileSafari', 'com.apple.WebKit', 'com.apple.webkit']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where (FileName in~ (AppleProcesses) or ProcessCommandLine has_any (AppleProcesses))
| where InitiatingProcessFileName !in~ ('launchd', 'xpc', 'com.apple.launchd')
| join kind=leftouter (
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemotePort in (80, 443, 8080, 8443)
| where InitiatingProcessFileName in~ (AppleProcesses)
) on DeviceId, InitiatingProcessFileName
| union (
DeviceEvents
| where TimeGenerated >= ago(7d)
| where ActionType == "ProcessCrashed"
| where FileName in~ (AppleProcesses)
)
| project TimeGenerated, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort, ActionType
| order by TimeGenerated descDetects suspicious activity from Apple product processes including crashes, unusual network connections, and anomalous child process spawning that may indicate CVE-2022-48503 exploitation on macOS endpoints enrolled in Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Safari browser updates triggering process restarts
- Automated UI testing frameworks spawning WebKit processes
- Developer tools and Xcode simulators running Apple product processes
- Enterprise MDM solutions managing Apple device processes remotely
Other platforms for CVE-2022-48503
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Safari Child Shell Spawn (macOS)
Expected signal: Process launch event showing bash or osascript spawned in temporal proximity to Safari process activity; macOS Unified Log entries capturing both process starts
- Test 2WebKit Process Crash Simulation (macOS)
Expected signal: Crash report generated in ~/Library/Logs/DiagnosticReports/ for safaridriver; macOS Unified Log capturing SIGABRT receipt; endpoint EDR (CrowdStrike/Defender) process termination event with abnormal exit code
- Test 3Suspicious Outbound Connection from Safari Process (macOS)
Expected signal: Network connection event logged by endpoint EDR showing outbound TCP to port 4444 from curl process with Safari user-agent; DNS or network flow records capturing the connection attempt
Unlock Pro Content
Get the full detection package for CVE-2022-48503 including response playbook, investigation guide, and atomic red team tests.