Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in Microsoft Sentinel
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
KQL Detection Query
union CommonSecurityLog, DeviceNetworkEvents
| where TimeGenerated >= ago(24h)
| where DeviceVendor == "F5" or DeviceProduct has "BIG-IP"
| where Activity has_any ("overflow", "stack", "segfault", "crash", "core dump") or Message has_any ("buffer overflow", "stack smash", "segmentation fault", "tmm crash", "mcpd crash")
| extend RequestSize = toint(AdditionalExtensions)
| where RequestSize > 65535 or isnotempty(RequestSize) and RequestSize < 0
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, Activity, Message, LogSeverity
| union (
CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where DeviceProduct has "BIG-IP"
| where LogSeverity in ("Emergency", "Alert", "Critical")
| where Message has_any ("CVE-2025-53521", "K000156741", "K000160486", "stack overflow", "buffer overflow")
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, Activity, Message, LogSeverity
)
| order by TimeGenerated descDetects F5 BIG-IP buffer overflow exploitation via CommonSecurityLog and DeviceNetworkEvents, looking for crash signals, oversized payloads, and critical severity events referencing stack/buffer overflow conditions.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate high-volume traffic from load testing tools that may trigger oversized payload alerts
- BIG-IP software bugs or hardware faults causing unrelated crash logs with similar keywords
- Security scanners performing vulnerability assessments against BIG-IP devices
- Misconfigured applications sending malformed but benign requests to BIG-IP virtual servers
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.