Apple iOS/iPadOS Use-After-Free Exploitation (CVE-2023-41974)

let SuspiciousAppleDeviceEvents = DeviceEvents
| where ActionType in ("ProcessCreated", "ProcessInjected", "MemoryAllocationFailed")
| where DeviceName has_any ("iPhone", "iPad") or OSPlatform == "iOS"
| where Timestamp > ago(7d);
let MDMAlerts = DeviceInfo
| where OSPlatform == "iOS"
| where isnotempty(OSVersion)
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort in (4444, 8080, 8443, 1337)
    | where ActionType == "ConnectionSuccess"
    | where Timestamp > ago(7d)
) on DeviceId
| project DeviceId, DeviceName, OSVersion, RemoteIP, RemotePort, Timestamp;
SuspiciousAppleDeviceEvents
| union MDMAlerts
| extend CVE = "CVE-2023-41974"
| project Timestamp, DeviceName, ActionType, RemoteIP, RemotePort, CVE

index=mdm OR index=mobile_security sourcetype=apple_mdm OR sourcetype=jamf OR sourcetype=ms_intune
| eval is_ios = if(match(os_platform, "(?i)ios|ipados"), 1, 0)
| where is_ios=1
| eval suspicious_event = case(
    match(event_type, "(?i)jailbreak_detected|compliance_violation|device_compromised"), "jailbreak_or_compromise",
    match(event_type, "(?i)malware|exploit|shellcode"), "malware_indicator",
    match(dest_port, "^(4444|8080|8443|1337|5555)$"), "suspicious_outbound",
    true(), null()
)
| where isnotnull(suspicious_event)
| stats count by device_id, device_name, os_version, suspicious_event, src_ip, dest_ip, dest_port
| eval cve="CVE-2023-41974"
| table _time, device_name, os_version, suspicious_event, dest_ip, dest_port, count, cve

sequence by device.id with maxspan=10m
  [network where host.os.type == "ios" and
   network.direction == "outbound" and
   destination.port in (4444, 8080, 8443, 1337, 5555) and
   not destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
  [alert where host.os.type == "ios" and
   event.category == "intrusion_detection" and
   (rule.name like~ "*jailbreak*" or rule.name like~ "*exploit*" or rule.name like~ "*use-after-free*")]

SELECT devicetime, sourceip, destinationip, destinationport, username, CATEGORYNAME(category) as event_category, "devicePayload" 
FROM events 
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apple MDM', 'Jamf Pro', 'Microsoft Intune', 'MobileIron') 
AND ("devicePayload" ILIKE '%jailbreak%' 
     OR "devicePayload" ILIKE '%exploit%' 
     OR "devicePayload" ILIKE '%use-after-free%' 
     OR "devicePayload" ILIKE '%compliance_violation%'
     OR destinationport IN (4444, 8080, 8443, 1337, 5555))
AND LOGSOURCENAME(logsourceid) ILIKE '%iOS%' OR LOGSOURCENAME(logsourceid) ILIKE '%iPad%'
LAST 7 DAYS

_sourceCategory=mdm OR _sourceCategory=mobile/security OR _sourceCategory=jamf
| where os_type matches /(?i)ios|ipados/
| parse "device_id=*" as device_id nodrop
| parse "os_version=*" as os_version nodrop
| parse "event_type=*" as event_type nodrop
| parse "dest_port=*" as dest_port nodrop
| where event_type matches /(?i)jailbreak|exploit|compromise|malware/ 
  OR dest_port in ("4444", "8080", "8443", "1337", "5555")
| count by device_id, os_version, event_type, dest_port
| sort by _count desc
| fields device_id, os_version, event_type, dest_port, _count

rule cve_2023_41974_ios_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2023-41974 use-after-free in Apple iOS/iPadOS"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://support.apple.com/en-us/HT213938"

  events:
    (
      $network.metadata.event_type = "NETWORK_CONNECTION" and
      $network.principal.asset.platform_software.platform = "IOS" and
      $network.network.application_protocol != "HTTPS" and
      (
        $network.target.port = 4444 or
        $network.target.port = 8443 or
        $network.target.port = 1337 or
        $network.target.port = 5555
      ) and
      not net.ip_in_range_cidr($network.target.ip, "10.0.0.0/8") and
      not net.ip_in_range_cidr($network.target.ip, "192.168.0.0/16")
    ) or
    (
      $alert.metadata.event_type = "GENERIC_EVENT" and
      $alert.principal.asset.platform_software.platform = "IOS" and
      (
        re.regex($alert.metadata.description, `(?i)jailbreak|exploit|use.after.free|memory.corruption`) or
        re.regex($alert.security_result.summary, `(?i)jailbreak|exploit|use.after.free`)
      )
    )

  condition:
    $network or $alert
}

DeviceEvents
| filter device_platform = "iOS" or device_platform = "iPadOS"
| filter event_type in ["NetworkConnection", "ProcessEvent", "AlertEvent"]
| filter (
    (event_type = "NetworkConnection" and remote_port in [4444, 8080, 8443, 1337, 5555])
    or (event_type = "AlertEvent" and (pattern_name contains "jailbreak" or pattern_name contains "exploit" or severity >= "High"))
  )
| select device_id, device_name, os_version, event_type, remote_ip, remote_port, pattern_name, timestamp
| sort timestamp desc
| limit 1000