F5 BIG-IP iControl REST API Bash Endpoint Command Execution via POST (Proxy)

Alerts on POST requests to the BIG-IP iControl REST /mgmt/tm/util/bash endpoint that can execute shell commands.

FreeUnreviewedSigmamediumv1

f5-big-ip-icontrol-rest-api-bash-endpoint-command-execution-via-post-proxy-b59c98c6

title: F5 BIG-IP iControl REST API Bash Endpoint Command Execution via POST (Proxy)
id: aeb45920-4a21-4bb8-a2d2-4b7fdb13d75c
related:
  - id: 85254a62-22be-4239-b79c-2ec17e566c37
    type: similar
  - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17
    type: derived
status: test
description: This rule flags HTTP POST requests sent to the F5 BIG-IP iControl REST API endpoint /mgmt/tm/util/bash, which is used to execute shell commands on the BIG-IP device. Attackers can abuse this functionality for unauthorized command execution and system control. The detection relies on proxy telemetry capturing the HTTP method and the requested URI path suffix.
references:
  - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
  - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
  - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-11-08
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: proxy
detection:
  selection:
    cs-method: POST
    c-uri|endswith: /mgmt/tm/util/bash
  condition: selection
falsepositives:
  - Legitimate usage of the BIG IP REST API to execute command for administration purposes
level: medium
license: DRL-1.1

What it detects

This rule flags HTTP POST requests sent to the F5 BIG-IP iControl REST API endpoint /mgmt/tm/util/bash, which is used to execute shell commands on the BIG-IP device. Attackers can abuse this functionality for unauthorized command execution and system control. The detection relies on proxy telemetry capturing the HTTP method and the requested URI path suffix.

Known false positives

Legitimate usage of the BIG IP REST API to execute command for administration purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.