F5 BIG-IP iControl Rest API Command Execution via Proxy

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•1•0•30

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands on the F5 BIG-IP device.