F5 BIG-IP iControl REST API bash Endpoint Command Execution via Webserver POST

Alerts on webserver POST requests to the BIG-IP iControl REST bash execution endpoint (/mgmt/tm/util/bash).

FreeUnreviewedSigmamediumv1

f5-big-ip-icontrol-rest-api-bash-endpoint-command-execution-via-webserver-post-85254a62

title: F5 BIG-IP iControl REST API bash Endpoint Command Execution via Webserver POST
id: 4756f986-d1ae-496a-a817-a2d195d3b559
related:
  - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17
    type: similar
  - id: 85254a62-22be-4239-b79c-2ec17e566c37
    type: derived
status: test
description: This rule flags HTTP POST requests to the F5 BIG-IP iControl REST API endpoint used for executing bash commands. Attackers can abuse this functionality to run operating system commands through the web interface when the endpoint is reachable. The detection relies on webserver telemetry capturing request method and the URI query path ending in /mgmt/tm/util/bash.
references:
  - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
  - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
  - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-11-08
tags:
  - attack.execution
  - attack.t1190
  - attack.initial-access
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|endswith: /mgmt/tm/util/bash
  condition: selection
falsepositives:
  - Legitimate usage of the BIG IP REST API to execute command for administration purposes
level: medium
license: DRL-1.1

What it detects

This rule flags HTTP POST requests to the F5 BIG-IP iControl REST API endpoint used for executing bash commands. Attackers can abuse this functionality to run operating system commands through the web interface when the endpoint is reachable. The detection relies on webserver telemetry capturing request method and the URI query path ending in /mgmt/tm/util/bash.

Known false positives

Legitimate usage of the BIG IP REST API to execute command for administration purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.