F5 TMUI RCE CVE-2020-5902 - contribution from Shannon ymls and updates

detections/detect_f5_tmui_rct_cve_2020_5902.yml

@@ -0,0 +1,35 @@
+name: Detect F5 TMUI RCE CVE-2020-5902
+id: 810e4dbc-d46e-11ea-87d0-0242ac130003
+version: 1
+date: '2020-08-02'
+description: This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices
+how_to_implement: 'To consistently detect exploit attempts on F5 devices using the vulnerabilities
+contained within CVE-2020-5902 it is recommended to ingest logs via syslog.  As many BIG-IP devices will
+have SSL enabled on their management interfaces, detections via wire data may not pick anything up unless
+you are decrypting SSL traffic in order to inspect it.  I am using a regex string from a Cloudflare
+mitigation technique to try and always catch the offending string (..;), along with the other exploit of using
+(hsqldb;).'
+type: ESCU
+references:
+- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
+- https://support.f5.com/csp/article/K52145254
+- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
+author: Shannon Davis, Splunk
+search: '`f5_bigip_rogue`
+| regex _raw="(hsqldb;|.*\\.\\.;.*)"
+| search `detect_f5_tmui_rce_cve_2020_5902_filter`'
+known_false_positives: unknown
+tags:
+  analytics_story:
+  - F5 TMUI RCE CVE-2020-5902
+  mitre_attack_id:
+  - T1190
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  - CIS 11
+  nist:
+  - DE.CM
+  security_domain: network
+  asset_type: Network

macros/f5_bigip_rogue.yml

@@ -0,0 +1,4 @@
+definition: index=netops sourcetype="f5:bigip:rogue"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: f5_bigip_rogue

response_tasks/get_notable_info.yml

@@ -69,4 +69,5 @@ tags:
   - Windows Service Abuse
   - Kubernetes Sensitive Role Activity
   - Kubernetes Sensitive Object Access Activity
+  - F5 TMUI RCE CVE-2020-5902
   - Windows DNS SIGRed CVE-2020-1350

stories/f5_tmui_rce_cve_2020_5902.yml

@@ -0,0 +1,27 @@
+name: F5 TMUI RCE CVE-2020-5902
+id: 7678c968-d46e-11ea-87d0-0242ac130003
+version: 1
+date: '2020-08-02'
+description: Uncover activity consistent with CVE-2020-5902.
+  Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ.
+  and Traffix SDC devices (vulnerable versions in F5 support link below).
+  This vulnerability allows unauthenticated users, along with authenticated users, who have access
+  to the configuration utility to execute system commands, create/delete files, disable services,
+  and/or execute Java code.  This vulnerability can result in full system compromise.
+narrative: 'A client is able to perform a remote code execution on an exposed and vulnerable system.
+  The detection search in this Analytic Story uses syslog to detect the malicious behavior.
+  Syslog is going to be the best detection method, as any systems using SSL to protect their management
+  console will make detection via wire data difficult.  The searches included used Splunk Connect For
+  Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define
+  the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/)'
+author: Shannon Davis, Splunk
+type: ESCU
+references:
+- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
+- https://support.f5.com/csp/article/K52145254
+- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
+tags:
+  analytics_story: F5 TMUI RCE CVE-2020-5902
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics