F5 BIG-IP CVE-2025-53521: BRICKSTORM Backdoor and Nation-State Exploitation

Threat Hunting IOCs & Queries

Known Indicators of Compromise

The following indicators are associated with BRICKSTORM backdoor deployment and CVE-2025-53521 exploitation. IOCs are current as of March 30, 2026. Threat actors frequently rotate infrastructure; use behavioral queries for persistent detection.

• File Hashes (SHA-256):
  • 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035 (Pg_update; BRICKSTORM ELF backdoor)
  • 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df (Listener; BRICKSTORM C2/socket handler)
  • aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878 (Vmprotect; BRICKSTORM variant)
• Suspicious File Paths:
  • /run/bigtlog.pipe (unexpected named pipe)
  • /run/bigstart.ltm (unexpected control file)
  • /var/sam/www/webtop/renderer/*.php (modified webshell files)
• Log Indicators:
  • /var/log/restjavad-audit.*.log (local user iControl REST API access from localhost)
  • /var/log/auditd/audit.log.* (SELinux disablement attempts)
• Scanning Endpoint: /mgmt/shared/identified-devices/config/device-info (reconnaissance target)
• Malware Identifier: c05d5254 (F5-designated malicious software classification)

BIG-IP Management Interface Reconnaissance Detection

Behavior Targeted: External scanning and probing of BIG-IP REST API endpoints, specifically /mgmt/shared/identified-devices/config/device-info, used by attackers to enumerate system information before exploitation.
MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1082 (System Information Discovery)
Expected Results: Events showing HTTP requests to BIG-IP management API endpoints from unexpected source IPs, indicating reconnaissance or active exploitation attempts.
False Positive Likelihood: LOW. The /mgmt/ path is administrative and should not receive external requests. Internal monitoring tools accessing this endpoint can be baselined and excluded.
Tuning Guidance: Adjust source IP exclusions for known management stations and monitoring tools. Expand URI patterns to include other F5 management paths if broader coverage is desired.

Splunk SPL Query

index=network sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype=firewall
    earliest=-7d
    dest_port=443 OR dest_port=8443
    uri_path="*/mgmt/shared/identified-devices/config/device-info*"
    OR uri_path="*/mgmt/tm/*"
    OR uri_path="*/tmui/login.jsp*"
| eval is_external=if(cidrmatch("10.0.0.0/8", src_ip) OR cidrmatch("172.16.0.0/12", src_ip) OR cidrmatch("192.168.0.0/16", src_ip), "internal", "external")
| search is_external="external"
| stats count, values(uri_path) as targeted_paths, earliest(_time) as first_seen, latest(_time) as last_seen by src_ip, dest_ip
| where count > 3
| table first_seen, last_seen, src_ip, dest_ip, targeted_paths, count
| sort - count

// TUNING: Adjust count threshold (currently >3) based on expected legitimate traffic
// TUNING: Add known scanner IPs to exclusion list
// TUNING: Modify dest_port to match your BIG-IP management port configuration

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (443, 8443)
| where RemoteUrl has_any ("/mgmt/shared/identified-devices/config/device-info", "/mgmt/tm/", "/tmui/login.jsp", "/tmui/system/")
| where ActionType == "ConnectionSuccess"
| summarize
    RequestCount = count(),
    TargetedPaths = make_set(RemoteUrl),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, RemoteIP, LocalIP
| where RequestCount > 3
| project FirstSeen, LastSeen, DeviceName, LocalIP, RemoteIP, TargetedPaths, RequestCount
| order by RequestCount desc

// TUNING: Adjust RequestCount threshold (currently >3) based on environment baseline
// TUNING: Add known management stations to exclusion with where RemoteIP !in ("x.x.x.x")
// NOTE: For Sentinel environments, substitute CommonSecurityLog if using firewall connector

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Anomalous HTTP 201 with CSS Content-Type (C2 Camouflage)

Behavior Targeted: BRICKSTORM's C2 communication pattern uses HTTP 201 response codes with CSS content-type headers to disguise command-and-control traffic as legitimate web responses.
MITRE ATT&CK: T1071.001 (Application Layer Protocol: Web Protocols), T1036 (Masquerading)
Expected Results: Outbound HTTP/S traffic from BIG-IP appliances showing HTTP 201 (Created) responses combined with CSS content-type, indicating potential C2 camouflage.
False Positive Likelihood: LOW. HTTP 201 responses with CSS content-type is an unusual combination rarely seen in legitimate traffic.
Tuning Guidance: Baseline normal BIG-IP traffic patterns first. Exclude known CDN or CSS delivery endpoints. Requires TLS inspection or proxy log visibility for HTTPS traffic.

Splunk SPL Query

index=proxy OR index=network sourcetype="squid" OR sourcetype="bluecoat:proxysg:access:syslog" OR sourcetype="zscaler" OR sourcetype="pan:traffic"
    earliest=-7d
    http_status=201
    http_content_type="*css*"
| eval is_bigip_source=if(cidrmatch("YOUR_BIGIP_SUBNET/24", src_ip), "yes", "no")
| search is_bigip_source="yes"
| stats count, values(dest_ip) as dest_ips, values(url) as urls by src_ip, http_content_type
| where count > 5
| table _time, src_ip, dest_ips, urls, http_content_type, count
| sort - count

// TUNING: Replace YOUR_BIGIP_SUBNET/24 with your actual BIG-IP management subnet
// TUNING: Adjust count threshold (currently >5) based on traffic volume
// FALSE POSITIVES: Dynamic CSS generators or CDN traffic may match; verify dest_ip reputation

Microsoft KQL Query (Defender/Sentinel)

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where SourceIP in ("YOUR_BIGIP_MGMT_IP1", "YOUR_BIGIP_MGMT_IP2")
| where DestinationPort == 443
| where RequestMethod == "POST" or RequestMethod == "GET"
| where AdditionalExtensions has "201" and AdditionalExtensions has "css"
| summarize
    ConnectionCount = count(),
    DistinctDestinations = dcount(DestinationIP),
    DestIPs = make_set(DestinationIP)
    by SourceIP, DeviceVendor
| where ConnectionCount > 5
| project SourceIP, DestIPs, DistinctDestinations, ConnectionCount, DeviceVendor
| order by ConnectionCount desc

// TUNING: Replace YOUR_BIGIP_MGMT_IP values with actual BIG-IP management IPs
// TUNING: Adjust ConnectionCount threshold based on normal traffic patterns
// NOTE: Requires proxy or firewall logs forwarded to Sentinel via CommonSecurityLog

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

iControl REST API Localhost Access Detection

Behavior Targeted: Attackers with shell access on compromised BIG-IP systems access the iControl REST API from localhost using local user accounts for privilege escalation and SELinux disablement.
MITRE ATT&CK: T1078 (Valid Accounts), T1562.001 (Impair Defenses: Disable or Modify Tools)
Expected Results: Log entries showing REST API access from 127.0.0.1 or localhost by local user accounts, particularly requests modifying security configurations.
False Positive Likelihood: MEDIUM. Legitimate BIG-IP automation scripts access the REST API locally. Baseline normal patterns and filter known service accounts.
Tuning Guidance: Establish baseline of normal local REST API access. Add known automation service accounts to exclusion lists. Focus on API calls that modify security settings such as SELinux or authentication modules.

Splunk SPL Query

index=network sourcetype="syslog" OR sourcetype="f5:bigip:syslog"
    earliest=-14d
    ("restjavad-audit" OR "iControl" OR "REST")
    ("127.0.0.1" OR "localhost")
| rex field=_raw "user=(?<api_user>[^\s,]+)"
| rex field=_raw "(?<api_method>GET|POST|PUT|PATCH|DELETE)\s+(?<api_path>/[^\s]+)"
| where isnotnull(api_user) AND isnotnull(api_path)
| eval suspicious=if(match(api_path, "selinux|security|auth|sys-eicheck"), "HIGH", "MEDIUM")
| stats count, values(api_method) as methods, values(api_path) as api_paths, values(suspicious) as risk_level by api_user, host
| where count > 10
| table _time, host, api_user, methods, api_paths, risk_level, count
| sort - count

// TUNING: Adjust count threshold (currently >10) based on normal API activity
// TUNING: Add known automation accounts to exclusion list
// TUNING: Expand suspicious path patterns for additional sensitive endpoints
// REQUIRES: BIG-IP restjavad-audit log forwarding via syslog

Microsoft KQL Query (Defender/Sentinel)

Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("restjavad-audit", "iControl", "REST")
| where SyslogMessage has_any ("127.0.0.1", "localhost")
| extend ApiUser = extract("user=([^\\s,]+)", 1, SyslogMessage)
| extend ApiMethod = extract("(GET|POST|PUT|PATCH|DELETE)\\s+(/[^\\s]+)", 1, SyslogMessage)
| extend ApiPath = extract("(GET|POST|PUT|PATCH|DELETE)\\s+(/[^\\s]+)", 2, SyslogMessage)
| where isnotempty(ApiUser) and isnotempty(ApiPath)
| extend RiskLevel = iff(ApiPath has_any ("selinux", "security", "auth", "sys-eicheck"), "HIGH", "MEDIUM")
| summarize
    RequestCount = count(),
    Methods = make_set(ApiMethod),
    Paths = make_set(ApiPath),
    RiskLevels = make_set(RiskLevel)
    by ApiUser, HostName
| where RequestCount > 10
| project HostName, ApiUser, Methods, Paths, RiskLevels, RequestCount
| order by RequestCount desc

// TUNING: Adjust RequestCount threshold (currently >10) based on normal API usage
// TUNING: Add known automation service accounts to exclusion with where ApiUser !in ("known_svc")
// REQUIRES: BIG-IP syslog forwarding to Sentinel via Syslog connector

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

BRICKSTORM Long-Lived Tunnel Detection (WebSocket/HTTP2)

Behavior Targeted: BRICKSTORM establishes persistent C2 channels using HTTP/2 with WebSocket upgrade and Yamux multiplexing. This query identifies anomalous long-lived outbound connections from BIG-IP management interfaces.
MITRE ATT&CK: T1572 (Protocol Tunneling), T1573 (Encrypted Channel), T1071.001 (Application Layer Protocol)
Expected Results: Long-duration outbound connections from BIG-IP management IPs with session lengths exceeding 30 minutes to external destinations, indicating persistent C2 tunneling.
False Positive Likelihood: MEDIUM. Legitimate admin sessions and monitoring tools create persistent connections. Baseline management interface connection patterns and exclude known destinations.
Tuning Guidance: Adjust connection duration threshold based on normal management interface session lengths. Add known monitoring tool destinations and update server IPs to exclusion lists.

Splunk SPL Query

index=network sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype=firewall
    earliest=-7d
    src_ip IN ("YOUR_BIGIP_MGMT_IP1", "YOUR_BIGIP_MGMT_IP2")
    action=allowed
    dest_port=443
| eval duration_minutes=round(duration/60, 2)
| where duration_minutes > 30
| eval is_internal_dest=if(cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip), "internal", "external")
| search is_internal_dest="external"
| stats count, avg(duration_minutes) as avg_duration, max(duration_minutes) as max_duration, values(dest_ip) as dest_ips, sum(bytes_out) as total_bytes_out by src_ip
| where count > 3
| table src_ip, dest_ips, count, avg_duration, max_duration, total_bytes_out
| sort - max_duration

// TUNING: Replace YOUR_BIGIP_MGMT_IP values with actual management IPs
// TUNING: Adjust duration_minutes threshold (currently >30 min) based on normal session lengths
// TUNING: Adjust count threshold (currently >3) for sensitivity
// FALSE POSITIVES: Software updates, backup transfers, legitimate admin sessions

Microsoft KQL Query (Defender/Sentinel)

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where SourceIP in ("YOUR_BIGIP_MGMT_IP1", "YOUR_BIGIP_MGMT_IP2")
| where DestinationPort == 443
| where DeviceAction == "allow"
| extend ConnectionDurationMin = toint(FlexNumber1) / 60
| where ConnectionDurationMin > 30
| where not(ipv4_is_private(DestinationIP))
| summarize
    SessionCount = count(),
    AvgDuration = avg(ConnectionDurationMin),
    MaxDuration = max(ConnectionDurationMin),
    DestIPs = make_set(DestinationIP),
    TotalSentBytes = sum(SentBytes)
    by SourceIP
| where SessionCount > 3
| project SourceIP, DestIPs, SessionCount, AvgDuration, MaxDuration, TotalSentBytes
| order by MaxDuration desc

// TUNING: Replace YOUR_BIGIP_MGMT_IP values with actual management interface IPs
// TUNING: Adjust ConnectionDurationMin threshold (currently >30) based on normal patterns
// TUNING: FlexNumber1 field varies by firewall vendor; check your CIM mapping for duration
// FALSE POSITIVES: Long-running admin sessions, backup jobs, monitoring tools

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.