Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in Elastic Security
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
Elastic Detection Query
sequence by host.name with maxspan=5m
[network where host.os.type == "linux" and
(destination.port in (443, 80, 8080, 8443, 4353) or destination.port >= 1024) and
network.bytes > 65535 and
(destination.address : ("*f5*", "*bigip*") or source.address : ("*f5*", "*bigip*"))]
[process where host.os.type == "linux" and
process.name in ("tmm", "mcpd", "httpd", "tmsh") and
event.action in ("crash", "segfault", "core_dump") or
process.args : ("*overflow*", "*stack*", "*CVE-2025-53521*")]
| head 100EQL sequence detection correlating oversized network payloads to BIG-IP process crashes on the same host within 5 minutes, indicating potential stack buffer overflow exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate large uploads causing temporary memory pressure on BIG-IP without exploitation
- BIG-IP process restarts due to configuration changes or software updates
- Authorized penetration testing generating crash conditions on BIG-IP test instances
- Hardware memory errors producing false crash telemetry unrelated to network activity
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.