F5 BIG-IP iControl REST Webserver POST to /mgmt/tm/util/bash Command Execution

Alerts on webserver POST requests to the BIG-IP iControl REST bash execution endpoint (/mgmt/tm/util/bash).

FreeReviewedSigma · Medium · v2

Category: webserver
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo (SigmaHQ), DRL 1.1
Published: 2023-11-08
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies HTTP POST requests to the F5 BIG-IP iControl REST API endpoint /mgmt/tm/util/bash. That endpoint is designed to execute shell commands on the BIG-IP, so abuse can lead to remote command execution. The detection relies on webserver telemetry capturing the HTTP method (POST) and the requested URI path ending with /mgmt/tm/util/bash.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Cleo Autorun Exploitation via Healthcheck File Drop

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Cisco IOS XE Configuration Change by Web UI WSMA User

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

F5 BIG-IP iControl REST Webserver POST to /mgmt/tm/util/bash Command Execution

Pivot detection · T1190 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

f5-big-ip-icontrol-rest-api-bash-endpoint-command-execution-via-webserver-post-85254a62

title: F5 BIG-IP iControl REST Webserver POST to /mgmt/tm/util/bash Command Execution
id: 4756f986-d1ae-496a-a817-a2d195d3b559
related:
  - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17
    type: similar
  - id: 85254a62-22be-4239-b79c-2ec17e566c37
    type: derived
status: test
description: This rule identifies HTTP POST requests to the F5 BIG-IP iControl REST API endpoint /mgmt/tm/util/bash. That endpoint is designed to execute shell commands on the BIG-IP, so abuse can lead to remote command execution. The detection relies on webserver telemetry capturing the HTTP method (POST) and the requested URI path ending with /mgmt/tm/util/bash.
references:
  - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
  - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
  - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-11-08
tags:
  - attack.execution
  - attack.t1190
  - attack.initial-access
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|endswith: /mgmt/tm/util/bash
  condition: selection
falsepositives:
  - Legitimate usage of the BIG IP REST API to execute command for administration purposes
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL