F5 BIG-IP iControl Rest API Command Execution - Proxy

Title: F5 BIG-IP iControl Rest API Command Execution - Proxy
Status: test
Description:Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
References:
  -https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
  -https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
  -https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Date: 2023-11-08
modified:None
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• category: proxy

Detection:
  selection:
    cs-method: 'POST'
    c-uri|endswith: '/mgmt/tm/util/bash'
  condition:selection
Falsepositives:
  -Legitimate usage of the BIG IP REST API to execute command for administration purposes
Level: medium