{"id":"85254a62-22be-4239-b79c-2ec17e566c37","title":"F5 BIG-IP iControl Rest API Command Execution - Webserver","description":"Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","status":"test","level":"medium","date":"2023-11-08","modified":"","tags":["attack.execution","attack.t1190","attack.initial-access"],"technique_ids":["T1190"],"logsource":{"category":"webserver"},"falsepositives":["Legitimate usage of the BIG IP REST API to execute command for administration purposes"],"references":["https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash","https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029","https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516"],"source_path":"rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml","source_sha256":"f5ac1183c9197251de489417f35b5a7940eb38ab86666c4d689bc6cff935f088","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: F5 BIG-IP iControl Rest API Command Execution - Webserver\nid: 85254a62-22be-4239-b79c-2ec17e566c37\nrelated:\n    - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17\n      type: similar\nstatus: test\ndescription: Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP\nreferences:\n    - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash\n    - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029\n    - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516\nauthor: Nasreddine Bencherchali (Nextron Systems), Thurein Oo\ndate: 2023-11-08\ntags:\n    - attack.execution\n    - attack.t1190\n    - attack.initial-access\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: 'POST'\n        cs-uri-query|endswith: '/mgmt/tm/util/bash'\n    condition: selection\nfalsepositives:\n    - Legitimate usage of the BIG IP REST API to execute command for administration purposes\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/85254a62-22be-4239-b79c-2ec17e566c37.json","kind":"sigma"}