Apple Multiple Products Classic Buffer Overflow Exploitation (CVE-2025-43520)

let AppleProcesses = dynamic(['com.apple.webkit', 'Safari', 'AppleScript', 'coreaudiod', 'imagent', 'mediaserverd', 'avatard', 'bluetoothd', 'configd']);
union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where TimeGenerated >= ago(7d)
| where DeviceType == 'Mac'
| where (
    (ActionType == 'ProcessCrashed' and ProcessVersionInfoProductName has_any (AppleProcesses))
    or (ActionType == 'ProcessCreated' and InitiatingProcessFileName has_any (AppleProcesses) and FileName in~ ('bash', 'sh', 'zsh', 'python3', 'perl', 'osascript', 'curl', 'wget'))
    or (ActionType == 'NetworkConnectionAccepted' and InitiatingProcessFileName has_any (AppleProcesses) and RemotePort in (4444, 1337, 31337, 8080, 8443))
  )
| extend RiskSignal = case(
    ActionType == 'ProcessCrashed', 'ProcessCrash_PossibleOverflow',
    ActionType == 'ProcessCreated' and FileName in~ ('bash','sh','zsh'), 'ShellSpawnedFromAppleProcess',
    ActionType == 'NetworkConnectionAccepted', 'SuspiciousNetworkFromAppleProcess',
    'Unknown'
  )
| project TimeGenerated, DeviceName, DeviceId, AccountName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RiskSignal

index=mac_endpoints sourcetype IN (osquery:differential, jamf:events, crowdstrike:events:macos)
| eval apple_procs=mvappend("Safari", "com.apple.webkit", "coreaudiod", "imagent", "mediaserverd", "avatard", "bluetoothd", "configd", "AppleScript")
| where (event_type="process_crash" AND mvfind(apple_procs, process_name)>=0)
    OR (event_type="process_create" AND mvfind(apple_procs, parent_process_name)>=0 AND child_process_name IN ("bash", "sh", "zsh", "python3", "perl", "osascript", "curl", "wget"))
    OR (event_type="network_connection" AND mvfind(apple_procs, process_name)>=0 AND dest_port IN (4444, 1337, 31337, 8080, 8443))
| eval risk_signal=case(
    event_type="process_crash", "ProcessCrash_PossibleOverflow",
    event_type="process_create" AND child_process_name IN ("bash","sh","zsh"), "ShellSpawnedFromAppleProcess",
    event_type="network_connection", "SuspiciousNetworkFromAppleProcess",
    true(), "Unknown"
  )
| stats count by _time, host, user, event_type, process_name, child_process_name, parent_process_name, dest_ip, dest_port, risk_signal
| sort -_time

sequence by host.name with maxspan=5m
  [process where event.action == "process_started"
   and process.parent.name in ("Safari", "coreaudiod", "imagent", "mediaserverd", "avatard", "bluetoothd", "configd")
   and process.name in ("bash", "sh", "zsh", "python3", "perl", "osascript", "curl", "wget")]
  [network where event.action == "connection_attempted"
   and destination.port in (4444, 1337, 31337, 8080, 8443)]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  "username",
  "ProcessName",
  "ParentProcessName",
  "EventID",
  QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apple macOS', 'CrowdStrike Falcon', 'Carbon Black')
  AND (
    ("ProcessName" ILIKE '%bash%' OR "ProcessName" ILIKE '%sh%' OR "ProcessName" ILIKE '%python3%' OR "ProcessName" ILIKE '%osascript%')
    AND ("ParentProcessName" ILIKE '%Safari%' OR "ParentProcessName" ILIKE '%coreaudiod%' OR "ParentProcessName" ILIKE '%imagent%' OR "ParentProcessName" ILIKE '%mediaserverd%' OR "ParentProcessName" ILIKE '%avatard%')
  )
  OR (
    destinationport IN (4444, 1337, 31337, 8080, 8443)
    AND ("ProcessName" ILIKE '%Safari%' OR "ProcessName" ILIKE '%coreaudiod%' OR "ProcessName" ILIKE '%imagent%' OR "ProcessName" ILIKE '%mediaserverd%')
  )
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=macos/endpoint OR _sourceCategory=crowdstrike/macos
| json auto
| where (
    (event_type = "ProcessCreate" and parent_process in ("Safari", "coreaudiod", "imagent", "mediaserverd", "avatard", "bluetoothd", "configd") and process_name in ("bash", "sh", "zsh", "python3", "perl", "osascript", "curl", "wget"))
    or (event_type = "NetworkConnect" and process_name in ("Safari", "coreaudiod", "imagent", "mediaserverd", "avatard", "bluetoothd") and dest_port in ("4444", "1337", "31337", "8080", "8443"))
    or (event_type = "ProcessCrash" and process_name in ("Safari", "coreaudiod", "imagent", "mediaserverd", "avatard", "bluetoothd", "configd"))
  )
| eval risk = if(event_type = "ProcessCrash", "OverflowCrash", if(event_type = "ProcessCreate", "ShellSpawn", "SuspiciousNetwork"))
| count by _sourceHost, user, process_name, parent_process, dest_ip, dest_port, risk
| sort by _count desc

rule cve_2025_43520_apple_buffer_overflow {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2025-43520 Apple buffer overflow via shell spawn or suspicious network activity from Apple processes"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-43520"

  events:
    (
      $proc.metadata.event_type = "PROCESS_LAUNCH" and
      $proc.principal.process.file.full_path = /\/(Safari|coreaudiod|imagent|mediaserverd|avatard|bluetoothd|configd)/ and
      $proc.target.process.file.full_path = /\/(bash|sh|zsh|python3|perl|osascript|curl|wget)$/
    ) or
    (
      $proc.metadata.event_type = "NETWORK_CONNECTION" and
      $proc.principal.process.file.full_path = /\/(Safari|coreaudiod|imagent|mediaserverd|avatard|bluetoothd|configd)/ and
      $proc.target.ip_port.port in (4444, 1337, 31337, 8080, 8443)
    )

  condition:
    $proc
}

event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NetworkConnectIP6")
| where
  (
    event_simpleName = "ProcessRollup2"
    and ParentBaseFileName IN ("Safari", "coreaudiod", "imagent", "mediaserverd", "avatard", "bluetoothd", "configd")
    and FileName IN ("bash", "sh", "zsh", "python3", "perl", "osascript", "curl", "wget")
  )
  or
  (
    event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6")
    and LocalAddressIP4 != RemoteAddressIP4
    and RemotePort IN (4444, 1337, 31337, 8080, 8443)
    and ImageFileName MATCHES "/(Safari|coreaudiod|imagent|mediaserverd|avatard|bluetoothd|configd)/"
  )
| eval RiskCategory = if(event_simpleName = "ProcessRollup2", "ShellSpawnFromAppleProcess", "SuspiciousNetworkFromAppleProcess")
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, RemotePort, RiskCategory
| sort timestamp desc