Evasion Technique Detection in F5 ASM/AWAF

Evasion techniques are tactics used by attackers to bypass security measures by encoding or manipulating requests in ways that may evade detection. F5 ASM (Application Security Manager) has mechanisms in place to detect and mitigate such attempts by using a Normalization Process.

Normalization Process and Evasion Detection

Normalization refers to the process of decoding and standardizing requests that may have been encoded or obfuscated to evade security defenses. When a request is received by the system, it may be encoded multiple times to mask malicious content, making it harder for the system to detect attack signatures. F5 ASM performs decoding passes to ensure requests are processed in a consistent and secure manner.

---

Key Aspects of Evasion Detection:

1. Multiple Decoding Passes:

   • F5 ASM performs multiple passes of decoding (up to five) to uncover hidden or obfuscated malicious content. Each pass decodes the request one level further, ensuring any evasion technique involving double or triple encoding is detected.

2. Pass Count and Its Impact:

   • Default Setting: The default value for multiple decoding passes is set to 2. This means the system will attempt to decode the request twice to normalize it before analyzing for threats.

   • Higher Decoding Passes: Increasing the number of decoding passes (3-5) ensures deeper decoding, but it comes at the cost of system performance.

     • More passes (e.g., 4 or 5) could lead to slower processing of requests but provide more thorough inspection, detecting more complex evasion attempts.

3. Evasion Technique Triggering:

   • Evasion Trigger: When the system fails to normalize a request correctly (due to complex or multiple encodings), it triggers an evasion technique. This indicates that the system has encountered a request that likely employs evasion techniques.

4. Impact of Decoding Passes on Detection:

   • 2-3 Decoding Passes:

     • This is typically the minimum setting to detect evasion techniques.

     • Requests that are obfuscated using multiple encodings will trigger an evasion technique, but may not trigger an attack signature (if one exists), since the attack signature is likely hidden by the encoding.

   • 4 Decoding Passes:

     • This setting is more aggressive in decoding, which can uncover evasion tactics and also trigger an attack signature if one exists, in addition to detecting the evasion technique.

   • 5 Decoding Passes:

     • With this setting, the system performs extensive normalization.

     • It will trigger an attack signature (if one is configured) and does not trigger an evasion technique. This indicates that the system has decoded the request thoroughly enough to recognize any attack signature that matches.

---

Recommended Practices:

1. Lower Pass Counts (2-3):

   • Use blocking for evasion detection when setting the decoding passes to 2-3. This ensures that potentially dangerous requests are blocked before they can cause harm.

   • These settings are ideal for handling basic evasion techniques while balancing performance and security.

2. Higher Pass Counts (4-5):

   • If you need more robust protection, increasing the decoding passes can provide deeper analysis, especially for more sophisticated evasion attempts.

   • However, keep in mind the performance trade-off—the higher the number of decoding passes, the more intensive the processing.

3. Balancing Performance and Security:

   • F5 recommends using fewer decoding passes (2-3) if system performance is a concern, as it strikes a balance between security and speed.

   • For highly sensitive applications or environments where evasion is a significant concern, using 4-5 passes may be warranted, especially if performance can be sacrificed for security.

4. Configure Global Evasion Checks:

   • Evasion technique checks are applied globally to the security policy, ensuring that any attempts to bypass the policy through encoding techniques are detected consistently across the application.

---

Summary of Decoding Passes:

Decoding Passes	Trigger Actions	Impact
2-3 Passes	- Triggers Evasion Technique - Does not trigger attack signature	Balances performance and security for basic evasion
4 Passes	- Triggers Evasion Technique - Triggers Attack Signature (if exists)	Higher security with moderate performance impact
5 Passes	- Triggers Attack Signature (if exists) - Does not trigger evasion technique	Deepest normalization, highest security, performance-heavy

By adjusting the decoding pass settings appropriately and enabling the proper evasion technique detection, F5 ASM/AWAF helps mitigate the risks of attack evasion while maintaining the overall security and performance of web applications.