---
title: Suspicious F5 BIG-IP Configuration Change via Bash
id: a1b2c3d4-5678-90ab-cdef-123456789abc
status: experimental
description: Detects suspicious bash execution patterns often associated with exploitation of BIG-IP management interfaces.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/bin/bash'
    CommandLine|contains:
      - 'tmsh'
      - 'bigstart'
      - 'restjavad'
    CommandLine|re: '.*(curl|wget|nc|perl).*\|.*sh'
falsepositives:
  - Legitimate administrative management via CLI
level: high
---
title: Unusual Network Connection from BIG-IP Management Process
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects outbound network connections initiated by the BIG-IP management plane process, which may indicate reverse shell activity.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains: '/restjavad'
    DestinationPort:
      - 4444
      - 8080
      - 443
    Initiated: 'true'
falsepositives:
  - Legitimate API calls to external configuration management tools
level: critical
---
title: Potential Web Shell Upload Activity via HTTP
id: c3d4e5f6-7890-12ab-cdef-345678901cde
status: experimental
description: Detects potential web shell upload attempts targeting BIG-IP traffic management interfaces.
references:
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: web_access
  product: apache
detection:
  selection:
    cs-method|contains:
      - 'POST'
      - 'PUT'
    cs-uri-query|contains:
      - 'tmui/login.jsp'
      - 'tmui/locallb/workspace'
    cs-uri-stem|re: '.*\.(jsp|php|sh)$'
falsepositives:
  - Unknown, requires tuning based on legitimate application traffic
level: high

// Hunt for suspicious process execution on Linux endpoints hosting F5
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has "bash" 
| where ProcessCommandLine has_any ("tmsh", "bigstart", "restjavad")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| order by Timestamp desc

// Correlate F5 Management Access with failed authentication attempts
Syslog
| where Facility == "local0" 
| where ProcessName contains "httpd"
| where SyslogMessage has "Authentication failed"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| summarize count() by Computer, bin(TimeGenerated, 1h)

-- Hunt for F5 BIG-IP specific configuration changes or suspicious scripts
SELECT FullPath, Size, ModTime, Mode
FROM glob(globs='/config/bigip.conf', '/var/log/audit/**')
WHERE ModTime > now() - 7d

-- Scan running processes for suspicious network connections or shells
SELECT Pid, Name, Exe, Username, Cwd, Cmdline
FROM pslist()
WHERE Name =~ 'bash' 
   AND Cmdline =~ '(curl|wget|perl).*\|.*sh'
   OR Exe =~ '/tmp'

# Note: This is a template for checking versions. 
# Ensure you have the F5 iControlREST module or appropriate SSH libraries.

$F5Devices = @("bigip1.domain.local", "bigip2.domain.local")
$VulnerableVersions = @("15.1.0", "14.1.2") # Example list, verify against official F5 advisory for CVE-2025-53521

foreach ($Device in $F5Devices) {
    Write-Host "Checking $Device..."
    # Example API Call logic would go here (using Invoke-RestMethod)
    # $Version = Get-F5Version -Device $Device
    
    # if ($Version in $VulnerableVersions) {
    #     Write-Warning "[ALERT] $Device is running vulnerable version: $Version"
    # } else {
    #     Write-Host "[OK] $Device is patched or running safe version."
    # }
}

#!/bin/bash
# Check if Management Port is listening externally

echo "Checking Management Interface Exposure..."

# Check if port 443 is listening on non-loopback
if netstat -tuln | grep ':443' | grep -v '127.0.0.1' > /dev/null; then
    echo "[WARNING] Management interface appears exposed on external IP."
else
    echo "[INFO] Management interface does not appear to be listening externally."
fi

# Check for recent tmsh modifications
echo "Checking for recent tmsh config changes..."
find /config -name "bigip.conf" -mtime -1 -exec ls -l {} \;