{"id":"b59c98c6-95e8-4d65-93ee-f594dfb96b17","title":"F5 BIG-IP iControl Rest API Command Execution - Proxy","description":"Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","status":"test","level":"medium","date":"2023-11-08","modified":"","tags":["attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"category":"proxy"},"falsepositives":["Legitimate usage of the BIG IP REST API to execute command for administration purposes"],"references":["https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash","https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029","https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516"],"source_path":"rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml","source_sha256":"cee6474025857326340842354e861ee4b42b54df63f0ae818e13b979321d932b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: F5 BIG-IP iControl Rest API Command Execution - Proxy\nid: b59c98c6-95e8-4d65-93ee-f594dfb96b17\nrelated:\n    - id: 85254a62-22be-4239-b79c-2ec17e566c37\n      type: similar\nstatus: test\ndescription: Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP\nreferences:\n    - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash\n    - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029\n    - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516\nauthor: Nasreddine Bencherchali (Nextron Systems), Thurein Oo\ndate: 2023-11-08\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        cs-method: 'POST'\n        c-uri|endswith: '/mgmt/tm/util/bash'\n    condition: selection\nfalsepositives:\n    - Legitimate usage of the BIG IP REST API to execute command for administration purposes\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/b59c98c6-95e8-4d65-93ee-f594dfb96b17.json","kind":"sigma"}