CVE-2022-48503 Microsoft Sentinel · KQL

Detect CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability Exploitation in Microsoft Sentinel

Detects potential exploitation of CVE-2022-48503, an unspecified vulnerability affecting Apple multiple products. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Detection focuses on suspicious process activity, network connections, and crash telemetry from Apple ecosystem processes that may indicate exploitation attempts.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let AppleProcesses = dynamic(['Safari', 'WebKit', 'MobileSafari', 'com.apple.WebKit', 'com.apple.webkit']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where (FileName in~ (AppleProcesses) or ProcessCommandLine has_any (AppleProcesses))
| where InitiatingProcessFileName !in~ ('launchd', 'xpc', 'com.apple.launchd')
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(7d)
    | where RemotePort in (80, 443, 8080, 8443)
    | where InitiatingProcessFileName in~ (AppleProcesses)
) on DeviceId, InitiatingProcessFileName
| union (
    DeviceEvents
    | where TimeGenerated >= ago(7d)
    | where ActionType == "ProcessCrashed"
    | where FileName in~ (AppleProcesses)
)
| project TimeGenerated, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc
high severity medium confidence

Detects suspicious activity from Apple product processes including crashes, unusual network connections, and anomalous child process spawning that may indicate CVE-2022-48503 exploitation on macOS endpoints enrolled in Defender for Endpoint.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel

Required Tables

DeviceProcessEventsDeviceNetworkEventsDeviceEvents

False Positives & Tuning

  • Legitimate Safari browser updates triggering process restarts
  • Automated UI testing frameworks spawning WebKit processes
  • Developer tools and Xcode simulators running Apple product processes
  • Enterprise MDM solutions managing Apple device processes remotely

Other platforms for CVE-2022-48503

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Safari Child Shell Spawn (macOS)

    Expected signal: Process launch event showing bash or osascript spawned in temporal proximity to Safari process activity; macOS Unified Log entries capturing both process starts

  2. Test 2WebKit Process Crash Simulation (macOS)

    Expected signal: Crash report generated in ~/Library/Logs/DiagnosticReports/ for safaridriver; macOS Unified Log capturing SIGABRT receipt; endpoint EDR (CrowdStrike/Defender) process termination event with abnormal exit code

  3. Test 3Suspicious Outbound Connection from Safari Process (macOS)

    Expected signal: Network connection event logged by endpoint EDR showing outbound TCP to port 4444 from curl process with Safari user-agent; DNS or network flow records capturing the connection attempt

Last updated: 2026-06-19 Research depth: standard
References (6)

Response Playbook

Triage

  1. Identify the affected Apple device(s) and confirm the OS version and product(s) involved; cross-reference against Apple security advisories HT213340–HT213346 to determine if the device is running a vulnerable version.
  2. Review endpoint telemetry for the flagged device within a 24-hour window around the alert: look for Safari/WebKit process crashes, unexpected child process spawning (shells, interpreters), and outbound network connections to non-standard or suspicious IPs.
  3. Check whether the device has received the relevant Apple security patches; query MDM (e.g., Jamf, Mosyle) for patch compliance status and last check-in time.
  4. Determine if the affected user account has accessed any suspicious URLs, received phishing emails, or installed third-party extensions around the time of the alert.

Containment

  1. Isolate the affected macOS device from the network via MDM remote lock or CrowdStrike network containment to prevent lateral movement or data exfiltration while investigation proceeds.
  2. Revoke active user sessions and force re-authentication for the affected user account, particularly for any cloud or SaaS services accessed from the device, to limit blast radius of potential credential theft.

Evidence Collection

  1. Collect a full macOS Unified Log capture (`log collect --output /tmp/system_logs.logarchive`) from the affected device covering the alert timeframe, preserving crash reports from `/Library/Logs/DiagnosticReports/` and `~/Library/Logs/DiagnosticReports/`.
  2. Export browser history, cookies, and cache from Safari (`~/Library/Safari/`) and capture a memory image if live forensics tooling (e.g., osquery, Velociraptor) is available, focusing on WebKit process memory.

Escalation Criteria

  • !Escalate to incident response if lateral movement is detected from the affected device, if credentials are observed being exfiltrated, or if additional devices show similar Apple process anomalies within the same network segment.
  • !Escalate immediately if the affected device has privileged access (admin, service account, developer keys) or if the compromise correlates with access to sensitive internal systems or data repositories.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >macOS Unified Log entries (`/private/var/db/diagnostics/`) capturing process launch, crash, and network events for Safari/WebKit around the incident timeframe
  • >Crash reports in `/Library/Logs/DiagnosticReports/` and `~/Library/Logs/DiagnosticReports/` for WebKit or Safari processes, which may contain stack traces revealing exploit behavior
  • >Safari browsing history and cache at `~/Library/Safari/History.db` and `~/Library/Caches/com.apple.Safari/` to identify malicious URLs visited pre-exploitation
  • >LaunchAgent and LaunchDaemon plist files in `~/Library/LaunchAgents/` and `/Library/LaunchDaemons/` for persistence mechanisms dropped post-exploitation

Tuning Guidance

Begin by baselining Apple product process parent-child relationships in your environment over 14 days to identify legitimate patterns (e.g., MDM solutions, dev tooling). Exclude known-good parent processes such as Xcode, Instruments, and MDM agents by their code-signed bundle IDs. If crash-based detection generates excessive noise, narrow to crash events followed within 60 seconds by network connections to external IPs. Adjust severity to critical if your fleet includes devices with access to sensitive systems or high-privilege accounts.

Hunting Queries

Threat hunt for Apple WebKit/Safari processes spawned by shell interpreters or scripting engines over the past 30 days — a low-frequency, high-fidelity signal for CVE-2022-48503 or similar browser exploitation across the fleet

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ('Safari', 'WebKitWebProcess', 'com.apple.WebKit')
| where InitiatingProcessFileName in~ ('bash', 'zsh', 'sh', 'python', 'python3', 'ruby', 'perl', 'curl', 'wget', 'osascript')
| summarize count(), make_set(ProcessCommandLine), make_set(DeviceName) by InitiatingProcessFileName, FileName, bin(TimeGenerated, 1h)
| order by count_ desc
Hunting — SPL
spl 
index=endpoint (sourcetype=crowdstrike:events OR sourcetype=jamf:events)
| eval apple_proc=if(match(process_name, "(?i)(safari|webkit|webkitwebprocess)"), 1, 0)
| eval shell_parent=if(match(parent_process_name, "(?i)(bash|zsh|sh|python|ruby|perl|osascript|curl|wget)"), 1, 0)
| where apple_proc=1 AND shell_parent=1
| stats dc(host) as unique_hosts, count as total_events by process_name, parent_process_name
| sort -unique_hosts

Atomic Red Team Tests

Test 1 Simulate Safari Child Shell Spawn (macOS)
macos

Simulates the post-exploitation behavior of CVE-2022-48503 where an exploited Safari/WebKit process spawns a shell interpreter, generating the parent-child process relationship that detection rules target.

Command

bash 
open -a Safari --args 'about:blank' & sleep 2 && osascript -e 'do shell script "bash -c \"id > /tmp/cve_2022_48503_test.txt\""'

Cleanup

bash 
rm -f /tmp/cve_2022_48503_test.txt; pkill -f 'Safari' 2>/dev/null || true

Expected Telemetry

Process launch event showing bash or osascript spawned in temporal proximity to Safari process activity; macOS Unified Log entries capturing both process starts

Expected Detection

Alert triggered by parent-child process relationship detection rules (Splunk, CrowdStrike CQL) correlating Safari/WebKit activity with shell interpreter invocation

Test 2 WebKit Process Crash Simulation (macOS)
macos

Forces a WebKit process crash to generate the crash report artifacts and telemetry that detection rules monitoring for CVE-2022-48503 exploitation indicators would alert on.

Command

bash 
python3 -c "
import subprocess, os, signal, time
p = subprocess.Popen(['/usr/bin/safaridriver', '--port', '9999'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
time.sleep(2)
os.kill(p.pid, signal.SIGABRT)
print('Crash signal sent to safaridriver PID:', p.pid)
"

Cleanup

bash 
pkill -f safaridriver 2>/dev/null || true; rm -f ~/Library/Logs/DiagnosticReports/safaridriver*.crash 2>/dev/null || true

Expected Telemetry

Crash report generated in ~/Library/Logs/DiagnosticReports/ for safaridriver; macOS Unified Log capturing SIGABRT receipt; endpoint EDR (CrowdStrike/Defender) process termination event with abnormal exit code

Expected Detection

Crash-based detection rules in Splunk and Elastic EQL should trigger on the abnormal WebKit process termination; Defender DeviceEvents ActionType=ProcessCrashed for Safari-family processes

Test 3 Suspicious Outbound Connection from Safari Process (macOS)
macos

Simulates network-based post-exploitation behavior by establishing an outbound connection from a process masquerading as or launched in context of Safari, targeting a non-standard port as a C2 beacon indicator.

Command

bash 
curl -s --connect-timeout 5 --max-time 5 -A 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15' http://127.0.0.1:4444/ 2>/dev/null; echo 'Connection attempt complete (expected to fail in lab)'

Cleanup

bash 
echo 'No cleanup required — connection to localhost:4444 expected to fail'

Expected Telemetry

Network connection event logged by endpoint EDR showing outbound TCP to port 4444 from curl process with Safari user-agent; DNS or network flow records capturing the connection attempt

Expected Detection

Network-based detection rules (KQL DeviceNetworkEvents, QRadar AQL on non-standard ports) should log the connection attempt; alert may require correlation with Apple process context to fire at high confidence

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1203Exploitation for Client ExecutionT1059Command and Scripting InterpreterT1055Process Injection

Same Tactic: Initial Access

Popular Detections