Coverage › CVE-2020-5902

CVE-2020-5902 Stale Sigma

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

Vendor / product

F5 — BIG-IP

Description (CISA)

F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-22

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2020-5902

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

8 mapping objects across 8 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

• DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
  AN0648 Windows

  Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

  Tunable: AccessMask TimeWindow ParentProcessFilter
  AN0649 Linux

  Processes opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL ptrace → DC0035 Process Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TargetProcessName ToolProcessName
  AN0650 macOS

  Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

  macos:unifiedlog Code Execution & Entitlement Access → DC0034 Process Metadata

  macos:keychain Access to Keychain DB or system.keychain → DC0055 File Access

  macos:osquery Invocation of osascript or dylib injection → DC0032 Process Creation

  Tunable: KeychainAccessPath SignedBinaryStatus

Sigma rules tagged attack.t1003 (37)

All 37 rules on the technique page →

T1005 Data from Local System secondary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1059 Command and Scripting Interpreter primary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1070.004 File Deletion secondary impact

• DET0140 Behavioral Detection of Malicious File Deletion
  AN0392 Windows

  Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.

  WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  Tunable: TimeWindow FilePathPattern UserContext
  AN0393 Linux

  Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via rm, unlink, or secure deletion tools like shred, especially when performed by unexpected users or shortly after execution.

  auditd:SYSCALL PATH → DC0040 File Deletion

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: PathRegex TimeWindow SecureDeletionTool
  AN0394 macOS

  Detects removal of adversary artifacts via rm, unlink, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.

  fs:fsusage unlink, write → DC0061 File Modification

  macos:unifiedlog process → DC0032 Process Creation

  Tunable: FilePathRegex ToolUsageAnomaly
  AN0395 ESXi

  Detects manual or scripted removal of logs, artifacts, or malware droppings via rm or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.

  esxi:shell /var/log/shell.log → DC0040 File Deletion

  Tunable: LogFilePath TimeWindow

Sigma rules tagged attack.t1070.004 (15)

T1133 External Remote Services exploitation technique

• DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
  AN1004 Windows

  Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow
  AN1005 Linux

  Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

  auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata

  NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content

  NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

  Tunable: KnownSSHClients FailedLogonThreshold TimeWindow
  AN1006 macOS

  Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

  macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata

  macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation

  PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

  Tunable: KnownVNCServers TimeWindow
  AN1007 Containers

  Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

  ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content

  kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata

  NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

  Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged attack.t1133 (20)

All 20 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1552 Unsecured Credentials secondary impact

• DET0412 Detect Access or Search for Unsecured Credentials Across Platforms
  AN1153 Windows

  Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: TimeWindow SuspiciousProcessList
  AN1154 Linux

  Reading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.

  auditd:SYSCALL open/read system calls to ~/.bash_history or /etc/shadow → DC0055 File Access

  auditd:SYSCALL execution of tools like cat, grep, or awk on credential files → DC0064 Command Execution

  Tunable: SensitivePaths UserContext
  AN1155 macOS

  Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.

  macos:unifiedlog read access to ~/Library/Keychains or history files by terminal processes → DC0055 File Access

  macos:unifiedlog execution of 'security', 'cat', or 'grep' commands accessing credential storage → DC0064 Command Execution

  Tunable: ProcessName TargetPath
  AN1156 SaaS

  Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.

  saas:googleworkspace Accessed third-party credential management service → DC0002 User Account Authentication

  saas:zoom unusual web session tokens and automation patterns during login → DC0038 Application Log Content

  Tunable: TokenAnomalyThreshold AccessGeoLocation
  AN1157 Identity Provider

  Unauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.

  azure:signinlogs Reset password or download key from portal → DC0002 User Account Authentication

  AWS:CloudTrail GetSecretValue → DC0070 Cloud Service Metadata

  Tunable: SSOSettingScope SecretType
  AN1158 Containers

  Access to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.

  auditd:SYSCALL read of /run/secrets or docker volumes by non-entrypoint process → DC0055 File Access

  containerd:Events unusual process spawned from container image context → DC0032 Process Creation

  Tunable: EntrypointAllowlist VolumeMountPath
  AN1159 Network Devices

  Use of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.

  linux:syslog CLI access to 'show running-config', 'show password', or 'cat config.txt' → DC0064 Command Execution

  NSM:Flow large transfer from management IPs to unauthorized host → DC0085 Network Traffic Content

  Tunable: ManagementInterfaceIPs CommandPattern

Sigma rules tagged attack.t1552 (13)

Sigma rules tagged with this CVE directly

1 rule carries cve.2020-5902.