Suspicious Execution of F5 BIG-IP iControl Rest API Command - Proxy (via proxy)

title: Suspicious Execution of F5 BIG-IP iControl Rest API Command - Proxy (via proxy)
id: 132e13a5-0b4a-5ace-8320-7685e874ade2
status: stable
description: This rule detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which enables the execution of commands on the BIG-IP
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
    - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
    - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
author: Huntrule Team
date: 2026-03-26
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'POST'
        c-uri|endswith: '/mgmt/tm/util/bash'
    condition: selection
falsepositives:
    - Unknown
level: medium