CTI · corroborated · 2026-09-10

F5 BIG-IP APM in-memory PHP web shell rootkit

Full story & timeline

MITRE ATT&CK

• T1100 Web Shell Persistence
• T1059 Command and Scripting Interpreter Execution
• T1055 Process Injection Stealth
• T1562 Impair Defenses Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: F5 BIG-IP APM In-Memory PHP Web Shell Rootkit
id: b94b6ebf-66bc-46a9-869b-5df5fabf75b1
status: experimental
description: Detects in-memory PHP web shell injection targeting F5 BIG-IP APM devices. The rootkit injects a PHP web shell into the BIG-IP APM process, establishing persistent backdoor with no file artifacts on the filesystem. Related to PoisonedRefresh campaign (CVE-2025-53521).
references:
  - https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit
  - https://www.osintsights.com
author: Tia N. List
date: 2026-09-10
tags:
  - attack.t1100
  - attack.t1055
logsource:
  category: process_creation
  product: linux
detection:
  selection_apm_process:
    Image|endswith: '/apm'
    CommandLine|contains: 'php'
  selection_php_injection:
    ParentProcessName|endswith: '/apm'
    Image|endswith: '/php-cgi'
  selection_suspicious_apm:
    Image|endswith: '/apm'
    IntegrityLevel: 'High'
  condition: selection_apm_process or selection_php_injection or selection_suspicious_apm
falsepositives:
  - Legitimate BIG-IP APM PHP operations (rare in normal operation)
level: critical

References

• https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit
• https://www.osintsights.com