F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521)

union CommonSecurityLog, DeviceNetworkEvents
| where TimeGenerated >= ago(24h)
| where DeviceVendor == "F5" or DeviceProduct has "BIG-IP"
| where Activity has_any ("overflow", "stack", "segfault", "crash", "core dump") or Message has_any ("buffer overflow", "stack smash", "segmentation fault", "tmm crash", "mcpd crash")
| extend RequestSize = toint(AdditionalExtensions)
| where RequestSize > 65535 or isnotempty(RequestSize) and RequestSize < 0
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, Activity, Message, LogSeverity
| union (
    CommonSecurityLog
    | where TimeGenerated >= ago(24h)
    | where DeviceProduct has "BIG-IP"
    | where LogSeverity in ("Emergency", "Alert", "Critical")
    | where Message has_any ("CVE-2025-53521", "K000156741", "K000160486", "stack overflow", "buffer overflow")
    | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, Activity, Message, LogSeverity
)
| order by TimeGenerated desc

index=network OR index=f5 OR index=firewall sourcetype IN ("f5:bigip:syslog", "f5:bigip:ltm:log", "f5:bigip:apm:log", "cisco:asa", "pan:traffic")
| eval is_bigip=if(match(host, "(?i)bigip|f5|ltm|gtm|apm"), 1, 0)
| search is_bigip=1 OR vendor="F5"
| eval crash_signal=if(match(_raw, "(?i)(stack overflow|buffer overflow|segmentation fault|segfault|core dump|tmm.*crash|mcpd.*crash|stack smash|stack.*buffer|CVE-2025-53521|K000156741)"), 1, 0)
| eval large_payload=if(isnum(bytes) AND bytes > 65535, 1, 0)
| eval severity_critical=if(match(severity, "(?i)(emergency|alert|critical|emerg|crit)"), 1, 0)
| where crash_signal=1 OR (large_payload=1 AND severity_critical=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(dest_ip) as dest_ips values(severity) as severities by host
| eval risk_score=case(crash_signal=1 AND count > 5, "critical", crash_signal=1, "high", large_payload=1 AND severity_critical=1, "medium", true(), "low")
| sort - count
| table host, count, first_seen, last_seen, source_ips, dest_ips, severities, risk_score

sequence by host.name with maxspan=5m
  [network where host.os.type == "linux" and
   (destination.port in (443, 80, 8080, 8443, 4353) or destination.port >= 1024) and
   network.bytes > 65535 and
   (destination.address : ("*f5*", "*bigip*") or source.address : ("*f5*", "*bigip*"))]
  [process where host.os.type == "linux" and
   process.name in ("tmm", "mcpd", "httpd", "tmsh") and
   event.action in ("crash", "segfault", "core_dump") or
   process.args : ("*overflow*", "*stack*", "*CVE-2025-53521*")]
| head 100

SELECT
  LOGSOURCENAME(logsourceid) AS log_source,
  sourceip,
  destinationip,
  destinationport,
  eventdirection,
  QIDNAME(qid) AS event_name,
  UTF8(payload) AS raw_payload,
  starttime,
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%F5%'
  OR LOGSOURCETYPENAME(devicetype) ILIKE '%BIG-IP%'
  OR (UTF8(payload) ILIKE '%buffer overflow%'
    OR UTF8(payload) ILIKE '%stack overflow%'
    OR UTF8(payload) ILIKE '%segmentation fault%'
    OR UTF8(payload) ILIKE '%tmm crash%'
    OR UTF8(payload) ILIKE '%mcpd crash%'
    OR UTF8(payload) ILIKE '%CVE-2025-53521%'
    OR UTF8(payload) ILIKE '%K000156741%')
AND LOGSOURCETYPENAME(devicetype) ILIKE '%F5%'
AND starttime > NOW() - 86400000
ORDER BY magnitude DESC, starttime DESC
LIMIT 500

_sourceCategory=f5/bigip OR _sourceCategory=network/f5 OR _sourceName=*bigip*
| where _raw matches /(?i)(buffer overflow|stack overflow|stack smash|segmentation fault|segfault|tmm crash|mcpd crash|core dump|CVE-2025-53521|K000156741|K000160486)/
| parse regex "(?P<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as src_ip nodrop
| parse regex "severity=(?P<severity>\\w+)" as severity nodrop
| parse regex "(?P<process>tmm|mcpd|httpd|tmsh)" as process nodrop
| timeslice 5m
| count as event_count, values(src_ip) as source_ips, values(severity) as severities, values(process) as affected_processes by _timeslice, _sourceHost
| where event_count > 1
| sort by event_count desc

rule cve_2025_53521_f5_bigip_buffer_overflow {
  meta:
    author = "df00tech"
    description = "Detects F5 BIG-IP stack-based buffer overflow exploitation attempts (CVE-2025-53521)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-53521"

  events:
    (
      $e.metadata.vendor_name = "F5" or
      $e.metadata.product_name = /(?i)BIG-IP/
    ) and
    (
      $e.metadata.description = /(?i)(buffer overflow|stack overflow|stack smash|segmentation fault|tmm crash|mcpd crash|core dump)/ or
      $e.metadata.description = /CVE-2025-53521/ or
      $e.metadata.description = /K000156741/ or
      $e.network.sent_bytes > 65535
    ) and
    $e.metadata.event_type = "NETWORK_CONNECTION"

  condition:
    $e
}

#repo=base_activity
| DeviceVendor="F5" OR DeviceName=/(?i)BIG-IP/
| CommandLine=/(?i)(overflow|stack|segfault|crash|tmm|mcpd)/ OR FileName IN ["tmm", "mcpd", "httpd"]
| union (
    #repo=network
    | RemotePort IN [80, 443, 8080, 8443, 4353]
    | NetworkReceivedBytes > 65535
    | DeviceName=/(?i)(BIG-IP|bigip|f5ltm|f5gtm)/
  )
| groupby([DeviceName, LocalAddressIP4, RemoteAddressIP4, RemotePort, FileName, CommandLine])
| sort(field=_count, order=desc)
| limit 200