Detections · F5 BIG-IP APM zero-day exploitation

F5 BIG-IP APM suspicious post-exploitation shell

sigma · generated; parse required before publication

title: F5 BIG-IP APM suspicious post-exploitation shell
description: Detects shell execution spawned by the BIG-IP management or worker process
  after exploitation of the public-facing APM service.
logsource:
  product: linux
detection:
  selection:
    process.parent.name: tmm
    process.name: sh
  condition: selection
level: high
tags:
- attack.execution
- attack.t1059.004
references:
- https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog

F5 BIG-IP APM shell execution SPL

spl · template

index=linux (parent_process_name="tmm" AND process_name IN ("sh","bash")) | stats count by host, user, process_name, parent_process_name

F5 BIG-IP APM shell execution KQL

kql · template

DeviceProcessEvents | where InitiatingProcessFileName in~ ("tmm") and FileName in~ ("sh","bash") | summarize count() by DeviceName, AccountName, FileName