Coverage › CVE-2022-1388

CVE-2022-1388 Mapped Sigma

F5 BIG-IP Missing Authentication Vulnerability

Vendor / product

F5 — BIG-IP

Description (CISA)

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

Added to KEV

2022-05-10

Due date

2022-05-31

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-306

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2022-1388

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1548 Abuse Elevation Control Mechanism exploitation technique

• DET0345 Detection Strategy for Abuse Elevation Control Mechanism (T1548)
  AN0975 Windows

  Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: ElevatedProcessPath ParentProcessName TimeWindow
  AN0976 Linux

  Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.

  auditd:SYSCALL setuid or setgid bit changes → DC0059 File Metadata

  auditd:SYSCALL execve with UID ≠ EUID → DC0034 Process Metadata

  auditd:SYSCALL sudo or pkexec invocation → DC0021 OS API Execution

  Tunable: WatchedDirectories UserContext TimeWindow
  AN0977 macOS

  Detect execution of /usr/libexec/security_authtrampoline or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.

  macos:unifiedlog authorization execute privilege requests → DC0021 OS API Execution

  auditd:SYSCALL execve with escalated privileges → DC0034 Process Metadata

  fs:fsusage binary execution of security_authtrampoline → DC0032 Process Creation

  Tunable: WatchedBinaries ExecutionParent
  AN0978 Identity Provider

  Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.

  azure:signinlogs unusual role assumption or elevation path → DC0010 User Account Modification

  Tunable: AuthorizedRoleMappings TimeWindow
  AN0979 IaaS

  Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.

  AWS:CloudTrail role privilege expansion detected → DC0010 User Account Modification

  AWS:CloudTrail cross-account or unexpected assume role → DC0034 Process Metadata

  Tunable: PermittedRoleTransitions CrossAccountBoundary

Sigma rules tagged attack.t1548 (24)

All 24 rules on the technique page →