{"id":"a557ffe6-ac54-43d2-ae69-158027082350","title":"Huawei BGP Authentication Failures","description":"Detects BGP failures which may be indicative of brute force attacks to manipulate routing.","author":"Tim Brown","status":"test","level":"low","date":"2023-01-09","modified":"2023-01-23","tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.collection","attack.stealth","attack.t1078","attack.t1110","attack.t1557"],"technique_ids":["T1078","T1110","T1557"],"logsource":{"product":"huawei","service":"bgp","definition":"Requirements: huawei bgp logs need to be enabled and ingested"},"falsepositives":["Unlikely. Except due to misconfigurations"],"references":["https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf"],"source_path":"rules/network/huawei/bgp/huawei_bgp_auth_failed.yml","source_sha256":"adaf5020f932daf2e8d61f23ca92cf5566698ab8a88fab13db622ed478ecaa66","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/huawei/bgp/huawei_bgp_auth_failed.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Huawei BGP Authentication Failures\nid: a557ffe6-ac54-43d2-ae69-158027082350\nstatus: test\ndescription: Detects BGP failures which may be indicative of brute force attacks to manipulate routing.\nreferences:\n    - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\nmodified: 2023-01-23\ntags:\n    - attack.initial-access\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.credential-access\n    - attack.collection\n    - attack.stealth\n    - attack.t1078\n    - attack.t1110\n    - attack.t1557\nlogsource:\n    product: huawei\n    service: bgp\n    definition: 'Requirements: huawei bgp logs need to be enabled and ingested'\ndetection:\n    keywords_bgp_huawei:\n        '|all':\n            - ':179' # Protocol\n            - 'BGP_AUTH_FAILED'\n    condition: keywords_bgp_huawei\nfalsepositives:\n    - Unlikely. Except due to misconfigurations\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"}],"data_path":"data/detection-rules/a557ffe6-ac54-43d2-ae69-158027082350.json","kind":"sigma"}