Hunt

F5 BIG-IP APM zero-day exploitation

Hunt Strategy & Objective

Identify public exploitation of F5 BIG-IP APM through suspicious child-process execution and configuration exposure.

⏱️ Lookback: 30 days

Hunt Hypothesis

Exploitation of CVE-2026-94127 may be followed by shell execution from F5 worker processes or unexpected changes to APM/OAuth configuration.

Target Platforms & Environment

Linux Network

F5 BIG-IP systems with APM access policies and OAuth profiles; public CTI only.

Required Telemetry & Data Sources

F5 audit and request logs Linux process creation EDR telemetry

Procedural Hunting Sequence

1 Scope systems with APM and OAuth profiles and collect F5 plus EDR telemetry.
2 Search for tmm or management-service child processes spawning sh/bash and correlate with inbound requests.
3 Triage administration changes, unusual source networks, and benign maintenance windows.
4 Contain affected management paths, preserve logs and volatile state, and validate hotfix status.

Hunt Queries

Query Pattern 1

index=linux (parent_process_name="tmm" AND process_name IN ("sh","bash")) | stats count by host, user, process_name, parent_process_name

Query Pattern 2

DeviceProcessEvents | where InitiatingProcessFileName in~ ("tmm") and FileName in~ ("sh","bash") | summarize count() by DeviceName, AccountName, FileName

✓

True Positive Confirmation Evidence

● Unexpected shell child process from F5 worker context

● Inbound requests preceding anomalous process execution

● Unauthorized configuration or account changes

Benign & False Positive Explanations

● Vendor maintenance

● Authorized troubleshooting sessions

🔬 Forensic Artifacts to Collect & Preserve

F5 audit/request logs

process tree and command lines

filesystem and configuration timestamps

memory capture where authorized

Validation Checklist

Confirm affected configuration

Preserve timestamps and source IPs

Verify F5 hotfix and configuration integrity

Escalation Criteria

Unauthenticated source followed by shell execution

Persistence or credential access artifacts

Repeated exploitation attempts

Traceability & Related Detections

🔍 Evidence: 36ff363a-a4… 🔍 Evidence: ed93b551-d5… 🔍 Evidence: 851f4dac-8c… 🛡️ Detection: 56b3fe7f-1d… 🛡️ Detection: 8cf0c80a-eb… 🛡️ Detection: 2b91d326-8a…