CVE-2023-46747 Exploitation Attempt on F5 BIG-IP via Proxy

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•31

Detects exploitation activity targeting CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule specifically looks for POST requests to '/mgmt/tm/util/bash' containing hex-encoded or plain text strings related to '/tmui/Control/form' and 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp', which are indicators of the exploit attempting to create a new user.