""ET INFO F5 BIG-IP - Successful Password Reset Attempt - Observed Post CVE-2023-46747 Activity""

SID: 2049258

Revision: 1

Class Type: successful-admin

Metadata: attack_target Networking_Equipment, created_at 2023_11_20, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, updated_at 2023_11_20

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: any

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "/mgmt/tm/auth/user/"

  • Value: "|22|description|22|"

  • Value: "|22|encryptedPassword|22|"

  • Value: "|22|role|22|"

Within:

PCRE:

Special Options:

  • http_stat_code

  • file_data

source