Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529)

union DeviceProcessEvents, DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("Safari", "WebKit", "com.apple.WebKit", "WebProcess", "com.apple.WebKit.WebContent")
| where ActionType in ("ProcessCreated", "NetworkConnectionEvents") or FileName in~ ("WebProcess", "com.apple.WebKit.Networking")
| extend SuspiciousChild = iff(
    InitiatingProcessFileName in~ ("Safari", "WebProcess") and
    FileName in~ ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl"),
    true, false)
| where SuspiciousChild == true
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemoteUrl
| summarize count(), make_set(ProcessCommandLine), make_set(RemoteIP) by DeviceId, DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)

index=* sourcetype IN ("macos:unified_log", "jamf:pro", "crowdstrike:events", "carbon_black:process")
(process_name="WebProcess" OR process_name="com.apple.WebKit.WebContent" OR parent_process_name="Safari" OR parent_process_name="WebProcess")
| eval suspicious_child=if(match(process_name, "(sh|bash|zsh|python3|curl|wget|osascript|launchctl|xterm)"), 1, 0)
| where suspicious_child=1
| stats count min(_time) as firstSeen max(_time) as lastSeen values(process_name) as child_processes values(cmdline) as commands values(dest_ip) as dest_ips by src_host parent_process_name
| eval risk_score=if(count>3, "high", "medium")
| sort -count

sequence by host.id with maxspan=2m
  [process where event.type == "start"
    and process.name in ("Safari", "WebProcess", "com.apple.WebKit.WebContent")
    and host.os.family == "macos"]
  [process where event.type == "start"
    and process.parent.name in ("Safari", "WebProcess", "com.apple.WebKit.WebContent")
    and process.name in ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "xterm", "nc", "ncat")]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') as EventTime, sourceip, destinationip, username, "Process Name", "Parent Process Name", "Command", LOGSOURCENAME(logsourceid) as LogSource
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apple macOS', 'CrowdStrike Falcon Data Replicator', 'Carbon Black Defense')
AND ("Parent Process Name" ILIKE '%WebProcess%' OR "Parent Process Name" ILIKE '%Safari%' OR "Parent Process Name" ILIKE '%WebKit%')
AND ("Process Name" IN ('sh', 'bash', 'zsh', 'python3', 'curl', 'osascript', 'launchctl', 'nc', 'ncat', 'xterm'))
AND LOGSOURCE LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=macos* OR _sourceCategory=endpoint/crowdstrike OR _sourceCategory=endpoint/carbonblack
| json field=_raw "process.name" as process_name nodrop
| json field=_raw "process.parent.name" as parent_process_name nodrop
| json field=_raw "process.command_line" as cmdline nodrop
| json field=_raw "host.name" as hostname nodrop
| where parent_process_name in ("Safari", "WebProcess", "com.apple.WebKit.WebContent")
| where process_name in ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc", "ncat")
| count by hostname, parent_process_name, process_name, cmdline
| sort by _count desc

rule cve_2025_43529_webkit_uaf {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Apple WebKit use-after-free exploitation (CVE-2025-43529) via suspicious child process spawning from browser processes"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-43529"
    false_positives = "Browser automation, developer tooling"

  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    $parent.principal.process.file.full_path = /Safari|WebProcess|com\.apple\.WebKit/ nocase
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.file.full_path = /\/bin\/(sh|bash|zsh)|python3|curl|osascript|launchctl|ncat|\/usr\/bin\/nc/ nocase
    $child.principal.process.parent_pid = $parent.principal.process.pid
    $parent.principal.hostname = $child.principal.hostname

  match:
    $parent.principal.hostname over 2m

  condition:
    $parent and $child
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("Safari", "WebProcess", "com.apple.WebKit.WebContent")
| FileName IN ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc", "ncat", "xterm")
| PlatformType = "Mac"
| eval risk="CVE-2025-43529 WebKit UAF Exploitation Attempt"
| stats count() as EventCount, earliest(timestamp) as FirstSeen, latest(timestamp) as LastSeen, values(CommandLine) as Commands by aid, ComputerName, UserName, ParentBaseFileName, FileName, risk
| sort -EventCount