SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1

rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902 FILE
{
	meta:
		description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
		author = "Florian Roth (Nextron Systems)"
		id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"
		date = "2020-06-07"
		modified = "2023-12-05"
		reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
		score = 75
		quality = 85
		tags = "CVE-2020-5902, FILE"

	strings:
		$x1 = "rm -f /etc/ld.so.preload" ascii fullword
		$x2 = "echo \"* * * * * $LDR" ascii
		$x3 = ".sh -o /tmp/in.sh" ascii
		$x4 = "chmod a+x /etc/.modules/.tmp" ascii
		$x5 = "chmod +x /var/log/F5-logcheck"
		$s1 = "ulimit -n 65535" ascii fullword
		$s2 = "-s /usr/bin/wget " ascii
		$s3 = ".sh | sh" ascii

	condition:
		filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
}