to confirm if cookie is originated from F5 or other devices

The best way to be sure is to capture both sides of the connection via tcpdump and look for where the Set-Cookie header originated but in general, cookie persistence is a cookie called BIGipServer ( see here ) ASM has TSxxx... (see here ) and APM has a number of cookies that are listed here

if we are using ASM with LTM, we noticed there is a cookie called TSxxx, we had an irule in place for httponly and secureflag, but not sure why is it not working for the TSxxx cookie. Below is the irule, kindly advise.

when HTTP_RESPONSE { set var [HTTP::header values "Set-Cookie"] HTTP::header remove "Set-Cookie" foreach tcookie $var { HTTP::header insert "Set-Cookie" "${tcookie}; HttpOnly; Secure " } }

Please advise if there is any cases or incidents that the ASM TS cookies had been exploited before and the likelihood of being exploit?

I haven't seen it being exploited - it is specifically designed to prevent cookie exploits and maintain form integrity. It is encrypted and the likelihood of cookie exploitation is very low I would expect.