cscli scenarios install crowdsecurity/f5-big-ip-cve-2020-59021type: trigger2format: 2.03name: crowdsecurity/f5-big-ip-cve-2020-59024description: "F5 BIG-IP TMUI - RCE (CVE-2020-5902)"5filter: |6 evt.Meta.log_type in ["http_access-log", "http_error-log"] and7 (8 Upper(evt.Meta.http_path) matches Upper('/tmui/login.jsp/..;/tmui/[^.]+.jsp\\?(fileName|command|directoryPath|tabId)=')9 or10 Upper(evt.Meta.http_path) matches Upper('/tmui/login.jsp/%2E%2E;/tmui/[^.]+.jsp\\?(fileName|command|directoryPath|tabId)=')11 )12groupby: "evt.Meta.source_ip"13blackhole: 2m14labels:15 confidence: 316 spoofable: 017 classification:18 - attack.T119019 - attack.T159520 - cve.CVE-2020-590221 behavior: "http:exploit"22 label: "F5 BIG-IP TMUI - RCE"23 remediation: true24 service: f525