{"id":"56fa3cd6-f8d6-4520-a8c7-607292971886","title":"Cisco BGP Authentication Failures","description":"Detects BGP failures which may be indicative of brute force attacks to manipulate routing","author":"Tim Brown","status":"test","level":"low","date":"2023-01-09","modified":"2023-01-23","tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.collection","attack.stealth","attack.t1078","attack.t1110","attack.t1557"],"technique_ids":["T1078","T1110","T1557"],"logsource":{"product":"cisco","service":"bgp","definition":"Requirements: cisco bgp logs need to be enabled and ingested"},"falsepositives":["Unlikely. Except due to misconfigurations"],"references":["https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf"],"source_path":"rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml","source_sha256":"3154d81899425bc0bb13f15965190e59b91a6766b45c2530d39fcbfbab26f1d4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco BGP Authentication Failures\nid: 56fa3cd6-f8d6-4520-a8c7-607292971886\nstatus: test\ndescription: Detects BGP failures which may be indicative of brute force attacks to manipulate routing\nreferences:\n    - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\nmodified: 2023-01-23\ntags:\n    - attack.initial-access\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.credential-access\n    - attack.collection\n    - attack.stealth\n    - attack.t1078\n    - attack.t1110\n    - attack.t1557\nlogsource:\n    product: cisco\n    service: bgp\n    definition: 'Requirements: cisco bgp logs need to be enabled and ingested'\ndetection:\n    keywords_bgp_cisco:\n        '|all':\n            - ':179' # Protocol\n            - 'IP-TCP-3-BADAUTH'\n    condition: keywords_bgp_cisco\nfalsepositives:\n    - Unlikely. Except due to misconfigurations\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"}],"data_path":"data/detection-rules/56fa3cd6-f8d6-4520-a8c7-607292971886.json","kind":"sigma"}