""ET INFO F5 BIG-IP - Successful Command Execution via util/bash""

SID: 2049260

Revision: 1

Class Type: successful-admin

Metadata: affected_product F5, attack_target Networking_Equipment, created_at 2023_11_20, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, updated_at 2023_11_20

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: any

Destination Port: any

Flow: established,to_client

Contents:

• Value: "200"

• Value: "|22|command|22|"

• Value: "|22|utilCmdArgs|22|"

Within:

PCRE:

Special Options:

• http_stat_code

• file_data

• fast_pattern

source