CVE-2023-46747 Exploitation Activity - F5 BIG-IP Webserver

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•32

Detects exploitation activity of CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule looks for specific POST requests to '/mgmt/tm/util/bash' containing keywords related to form submission and user creation within the F5 BIG-IP Traffic Management User Interface (TMUI).