Detect Apple Multiple Products Classic Buffer Overflow Exploitation (CVE-2025-43520) in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2025-43520, a classic buffer overflow vulnerability (CWE-120) affecting Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Buffer overflow exploitation may manifest as abnormal process crashes, memory corruption signals, unexpected child process spawning from Apple system processes, or anomalous network connections following process exploitation.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let AppleProcesses = dynamic(['com.apple.webkit', 'Safari', 'AppleScript', 'coreaudiod', 'imagent', 'mediaserverd', 'avatard', 'bluetoothd', 'configd']);
union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where TimeGenerated >= ago(7d)
| where DeviceType == 'Mac'
| where (
(ActionType == 'ProcessCrashed' and ProcessVersionInfoProductName has_any (AppleProcesses))
or (ActionType == 'ProcessCreated' and InitiatingProcessFileName has_any (AppleProcesses) and FileName in~ ('bash', 'sh', 'zsh', 'python3', 'perl', 'osascript', 'curl', 'wget'))
or (ActionType == 'NetworkConnectionAccepted' and InitiatingProcessFileName has_any (AppleProcesses) and RemotePort in (4444, 1337, 31337, 8080, 8443))
)
| extend RiskSignal = case(
ActionType == 'ProcessCrashed', 'ProcessCrash_PossibleOverflow',
ActionType == 'ProcessCreated' and FileName in~ ('bash','sh','zsh'), 'ShellSpawnedFromAppleProcess',
ActionType == 'NetworkConnectionAccepted', 'SuspiciousNetworkFromAppleProcess',
'Unknown'
)
| project TimeGenerated, DeviceName, DeviceId, AccountName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RiskSignalDetects process crashes, unexpected shell spawning, and suspicious network connections from Apple system processes on macOS endpoints, which may indicate buffer overflow exploitation of CVE-2025-43520.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Apple software update crashes during patching cycles
- Developer or QA environments running stress tests against Apple frameworks
- Security scanning tools interacting with Apple processes during scheduled scans
- Legitimate shell scripts invoked by AppleScript automation workflows
Other platforms for CVE-2025-43520
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Shell Spawn from Apple-Like Parent Process
Expected signal: Process creation event showing osascript spawning bash; command line includes 'id' and 'hostname'.
- Test 2Simulate Suspicious Outbound Network Connection from Apple Process Context
Expected signal: Network connection attempt to port 4444 initiated by process tree rooted at osascript.
- Test 3Generate Apple Process Crash Report for Forensic Artifact Validation
Expected signal: Process crash event for bash with signal SIGSEGV; diagnostic report written to DiagnosticReports directory.
- Test 4Enumerate Persistence Mechanisms Post-Exploitation Simulation
Expected signal: File creation event for .plist file in ~/Library/LaunchAgents/; optional launchctl load event.
References (9)
- https://support.apple.com/en-us/125632
- https://support.apple.com/en-us/125633
- https://support.apple.com/en-us/125634
- https://support.apple.com/en-us/125635
- https://support.apple.com/en-us/125636
- https://support.apple.com/en-us/125637
- https://support.apple.com/en-us/125638
- https://support.apple.com/en-us/125639
- https://nvd.nist.gov/vuln/detail/CVE-2025-43520
Unlock Pro Content
Get the full detection package for CVE-2025-43520 including response playbook, investigation guide, and atomic red team tests.