Apple Multiple Products Buffer Overflow Exploitation (CVE-2025-31277)

let suspiciousAppleProcs = dynamic(["mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd"]);
let timeWindow = 1h;
union DeviceProcessEvents, DeviceEvents
| where Timestamp > ago(timeWindow)
| where DeviceType in ("Mac", "iOS") or OSPlatform has_any ("macOS", "iOS", "iPadOS")
| where (ActionType in ("ProcessCreated", "ProcessCrashed", "ExceptionThrown") and FileName in~ (suspiciousAppleProcs))
    or (ActionType == "ProcessCrashed" and ProcessCommandLine has_any ("overflow", "heap", "stack", "corrupt"))
    or (ActionType == "ProcessCreated" and InitiatingProcessFileName in~ (suspiciousAppleProcs) and FileName in~ ("sh", "bash", "zsh", "python3", "perl", "ruby"))
| extend RiskScore = case(
    ActionType == "ProcessCrashed" and FileName in~ (suspiciousAppleProcs), 90,
    ActionType == "ProcessCreated" and InitiatingProcessFileName in~ (suspiciousAppleProcs) and FileName in~ ("sh", "bash", "zsh"), 85,
    70
  )
| where RiskScore >= 70
| project Timestamp, DeviceName, DeviceId, AccountName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RiskScore
| sort by RiskScore desc, Timestamp desc

index=endpoint sourcetype IN ("jamf:pro", "crowdstrike:events", "carbon_black:edr", "sentinel_one") 
(os_type IN ("macos", "ios", "ipados") OR vendor="Apple")
| eval apple_system_procs=mvappend("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd", "notifyd")
| where (event_type="ProcessCrash" AND mvfind(apple_system_procs, process_name) >= 0)
    OR (event_type="ProcessCreate" AND mvfind(apple_system_procs, parent_process_name) >= 0 AND process_name IN ("sh", "bash", "zsh", "python3", "perl", "osascript"))
    OR (event_type="ExceptionEvent" AND exception_type IN ("EXC_BAD_ACCESS", "EXC_BAD_INSTRUCTION", "SIGSEGV", "SIGBUS") AND mvfind(apple_system_procs, process_name) >= 0)
| eval risk_score=case(
    event_type="ProcessCrash" AND mvfind(apple_system_procs, process_name) >= 0, 90,
    event_type="ProcessCreate" AND mvfind(apple_system_procs, parent_process_name) >= 0 AND process_name IN ("sh", "bash", "zsh"), 85,
    event_type="ExceptionEvent", 80,
    70
  )
| where risk_score >= 70
| stats count AS event_count, values(event_type) AS event_types, max(risk_score) AS max_risk, first(_time) AS first_seen, last(_time) AS last_seen BY host, user, process_name, parent_process_name
| where event_count >= 1
| sort - max_risk

sequence by host.id with maxspan=5m
  [process where host.os.type in ("macos", "ios") and
   process.name in ("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd") and
   event.action in ("process_stopped", "process_error", "crash")]
  [process where host.os.type in ("macos", "ios") and
   process.parent.name in ("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd") and
   process.name in ("sh", "bash", "zsh", "python3", "perl", "ruby", "osascript")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process,
  "Event Action" AS event_action,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apple macOS', 'CrowdStrike Falcon Host', 'Jamf')
  AND (
    (
      "Event Action" IN ('ProcessCrash', 'ExceptionThrown', 'SignalReceived')
      AND "Process Name" IN ('mdmclient', 'mobileassetd', 'softwareupdated', 'nsurlsessiond', 'trustd', 'accountsd', 'apsd', 'securityd', 'notifyd')
    )
    OR (
      "Parent Process Name" IN ('mdmclient', 'mobileassetd', 'softwareupdated', 'nsurlsessiond', 'trustd', 'accountsd', 'apsd', 'securityd')
      AND "Process Name" IN ('sh', 'bash', 'zsh', 'python3', 'perl', 'osascript', 'ruby')
    )
  )
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=endpoint/macos OR _sourceCategory=endpoint/crowdstrike OR _sourceCategory=endpoint/jamf
| where os_type in ("macos", "ios", "ipados") or vendor = "Apple"
| where (event_type in ("ProcessCrash", "ExceptionEvent", "SignalEvent") and process_name in ("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd", "notifyd"))
   or (parent_process_name in ("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd") and process_name in ("sh", "bash", "zsh", "python3", "perl", "osascript", "ruby"))
| timeslice 15m
| stats count as event_count, values(event_type) as event_types, values(process_name) as processes by _timeslice, host, user, parent_process_name
| where event_count > 0
| sort by event_count desc

rule cve_2025_31277_apple_buffer_overflow {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-31277 Apple buffer overflow exploitation via daemon crashes and shell spawning"
    severity = "HIGH"
    priority = "HIGH"
    cve = "CVE-2025-31277"
    mitre_attack = "T1203, T1068"

  events:
    (
      $crash.metadata.event_type = "PROCESS_UNCAUGHT_EXCEPTION"
      OR $crash.metadata.event_type = "PROCESS_TERMINATION"
    )
    AND $crash.principal.process.file.full_path = /\/(mdmclient|mobileassetd|softwareupdated|nsurlsessiond|trustd|accountsd|apsd|securityd|notifyd)$/
    AND $crash.principal.asset.platform_software.platform = "APPLE_MAC"

    $spawn.metadata.event_type = "PROCESS_LAUNCH"
    AND $spawn.principal.process.file.full_path = /(sh|bash|zsh|python3|perl|osascript|ruby)$/
    AND $spawn.principal.process.parent_process.file.full_path = /\/(mdmclient|mobileassetd|softwareupdated|nsurlsessiond|trustd|accountsd|apsd|securityd)$/
    AND $spawn.principal.asset.platform_software.platform = "APPLE_MAC"

    $crash.principal.hostname = $spawn.principal.hostname

  match:
    $crash.principal.hostname over 5m

  condition:
    $crash and $spawn
}

#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, ProcessExceptionEvent)
| where event.ProductType = "Mac"
| where (
    (event_simpleName IN ("ProcessExceptionEvent", "ProcessRollup2") AND FileName IN ("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd", "notifyd") AND ExitCode != 0)
    OR
    (event_simpleName = "ProcessRollup2" AND ParentBaseFileName IN ("mdmclient", "mobileassetd", "softwareupdated", "nsurlsessiond", "trustd", "accountsd", "apsd", "securityd") AND FileName IN ("sh", "bash", "zsh", "python3", "perl", "osascript", "ruby"))
  )
| eval risk = case(
    FileName IN ("sh", "bash", "zsh") AND ParentBaseFileName IN ("mdmclient", "mobileassetd", "trustd", "securityd"), "CRITICAL",
    event_simpleName = "ProcessExceptionEvent" AND FileName IN ("mdmclient", "mobileassetd", "softwareupdated"), "HIGH",
    "MEDIUM"
  )
| stats count() AS EventCount, values(FileName) AS Processes, values(CommandLine) AS Commands, max(risk) AS MaxRisk BY aid, UserName, ParentBaseFileName
| where EventCount >= 1
| sort MaxRisk asc