Branch was auto-updated.

detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

@@ -0,0 +1,68 @@
+name: F5 BIG-IP iControl REST Vulnerability CVE-2022-1388
+id: bb1c2c30-107a-4e56-a4b9-1f7022867bfe
+version: 1
+date: '2022-05-10'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies a recent unauthenticated remote code execution vulnerablity against the F5 BIG-IP iControl REST API. The analytic identifies the URI path found in the POCs and the HTTP Method of POST.
+  In addition, the request header will have the commands that may be executed in fields utilcmdargs and the auth field of X-F5-Auth-Token, which may have a random base64 encoded value.
+search: '| tstats count from datamodel=Web where 
+  Web.url="*/mgmt/tm/util/bash*" Web.http_method="POST" by Web.http_user_agent Web.http_method, Web.url,Web.url_length
+  Web.src, Web.dest | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  web or proxy logs, or ensure it is being filled by a proxy like device, into the
+  Web Datamodel. For additional filtering, allow list private IP space or restrict
+  by known good.
+known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
+references:
+  - https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml
+  - https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/
+  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
+  - https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ
+  - https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py
+tags:
+  analytic_story:
+  - F5 BIG-IP Vulnerability CVE-2022-1388
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/f5/f5.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred.
+  mitre_attack_id:
+  - T1190
+  cve:
+  - CVE-2022-1388
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 70
+  security_domain: network

stories/f5_big_ip_vulnerability_cve_2022_1388.yml

@@ -0,0 +1,24 @@
+name: F5 BIG-IP Vulnerability CVE-2022-1388
+id: 0367b177-f8d6-4c4b-a62d-86f52a590bff
+version: 1
+date: '2022-05-10'
+author: Michael Haag, Splunk
+description: CVE-2022-1388 is a unauthenticated remote code execution vulnerablity against BIG-IP iControl REST API. 
+narrative: CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks'' BIG-IP solution that enables an unauthenticated attacker to gain remote code execution on the system through bypassing F5''s iControl REST authentication. The vulnerability was first discovered by F5''s internal product security team and disclosed publicly on May 4, 2022, per Randori. 
+  This vulnerability,CVE-2022-1388, may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only per F5 article K23605346.
+  Is CVE-2022-1388 Exploitable? Yes. There are now multiple POC scripts available and reports of threat actors scanning and potentially exploiting the vulnerablity. Per Randori the specific interface needed to exploit this vulnerability is rarely publicly exposed, and the risk to most organizations of exploitation by an unauthenticated external actor is low. 
+references: 
+  - https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml
+  - https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/
+  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
+  - https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ
+  - https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py
+tags:
+  analytic_story: F5 BIG-IP Vulnerability CVE-2022-1388
+  category: 
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.test.yml

@@ -0,0 +1,13 @@
+name: F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 Unit Test
+tests:
+- name: F5 BIG-IP iControl REST Vulnerability CVE-2022-1388
+  file: network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: f5.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/f5/f5.log
+    source: pan:threat
+    sourcetype: pan:threat
+    update_timestamp: true