Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in CrowdStrike LogScale
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
LogScale Detection Query
#repo=base_activity
| DeviceVendor="F5" OR DeviceName=/(?i)BIG-IP/
| CommandLine=/(?i)(overflow|stack|segfault|crash|tmm|mcpd)/ OR FileName IN ["tmm", "mcpd", "httpd"]
| union (
#repo=network
| RemotePort IN [80, 443, 8080, 8443, 4353]
| NetworkReceivedBytes > 65535
| DeviceName=/(?i)(BIG-IP|bigip|f5ltm|f5gtm)/
)
| groupby([DeviceName, LocalAddressIP4, RemoteAddressIP4, RemotePort, FileName, CommandLine])
| sort(field=_count, order=desc)
| limit 200CrowdStrike Falcon LogScale query detecting F5 BIG-IP process anomalies and oversized inbound network payloads on BIG-IP-named devices that may indicate CVE-2025-53521 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate BIG-IP administrative processes spawning with stack or buffer in command arguments
- High-throughput application traffic through BIG-IP exceeding network byte thresholds
- BIG-IP monitoring agents collecting crash telemetry and logging related keywords
- CrowdStrike sensor deployment on BIG-IP management systems capturing unrelated process activity
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.