{"id":"50e606bf-04ce-4ca7-9d54-3449494bbd4b","title":"Cisco LDP Authentication Failures","description":"Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels","author":"Tim Brown","status":"test","level":"low","date":"2023-01-09","modified":"","tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.collection","attack.stealth","attack.t1078","attack.t1110","attack.t1557"],"technique_ids":["T1078","T1110","T1557"],"logsource":{"product":"cisco","service":"ldp","definition":"Requirements: cisco ldp logs need to be enabled and ingested"},"falsepositives":["Unlikely. Except due to misconfigurations"],"references":["https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf"],"source_path":"rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml","source_sha256":"31db3554c5444ae51464435eedcf435732f398f8e294e8ca2ef39bb1e231756f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco LDP Authentication Failures\nid: 50e606bf-04ce-4ca7-9d54-3449494bbd4b\nstatus: test\ndescription: Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels\nreferences:\n    - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\ntags:\n    - attack.initial-access\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.credential-access\n    - attack.collection\n    - attack.stealth\n    - attack.t1078\n    - attack.t1110\n    - attack.t1557\nlogsource:\n    product: cisco\n    service: ldp\n    definition: 'Requirements: cisco ldp logs need to be enabled and ingested'\ndetection:\n    selection_protocol:\n        - 'LDP'\n    selection_keywords:\n        - 'SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL'\n        - 'TCPMD5AuthenFail'\n    condition: selection_protocol and selection_keywords\nfalsepositives:\n    - Unlikely. Except due to misconfigurations\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"}],"data_path":"data/detection-rules/50e606bf-04ce-4ca7-9d54-3449494bbd4b.json","kind":"sigma"}