Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in Google Chronicle
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2025_53521_f5_bigip_buffer_overflow {
meta:
author = "df00tech"
description = "Detects F5 BIG-IP stack-based buffer overflow exploitation attempts (CVE-2025-53521)"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-53521"
events:
(
$e.metadata.vendor_name = "F5" or
$e.metadata.product_name = /(?i)BIG-IP/
) and
(
$e.metadata.description = /(?i)(buffer overflow|stack overflow|stack smash|segmentation fault|tmm crash|mcpd crash|core dump)/ or
$e.metadata.description = /CVE-2025-53521/ or
$e.metadata.description = /K000156741/ or
$e.network.sent_bytes > 65535
) and
$e.metadata.event_type = "NETWORK_CONNECTION"
condition:
$e
}Chronicle YARA-L rule detecting F5 BIG-IP buffer overflow exploitation indicators including crash signals, oversized payloads, and CVE reference strings from F5 vendor log sources.
Data Sources
Required Tables
False Positives & Tuning
- Large legitimate data transfers through BIG-IP virtual servers exceeding byte thresholds
- F5 security advisory content ingested via log forwarding pipelines containing CVE strings
- BIG-IP process crashes from software bugs or hardware issues unrelated to exploitation
- Authorized red team operations targeting BIG-IP infrastructure in test environments
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.