Cisco BGP Authentication Failures

Title: Cisco BGP Authentication Failures
Status: test
Description:Detects BGP failures which may be indicative of brute force attacks to manipulate routing
References:
  -https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Author: Tim Brown
Date: 2023-01-09
modified:2023-01-23
Tags:

• -'attack.initial-access'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.credential-access'
• -'attack.collection'
• -'attack.stealth'
• -'attack.t1078'
• -'attack.t1110'
• -'attack.t1557'

Logsource:

• product: cisco
• service: bgp
• definition: Requirements: cisco bgp logs need to be enabled and ingested

Detection:
  keywords_bgp_cisco:
    |all:
      -':179'
      -'IP-TCP-3-BADAUTH'

  condition:keywords_bgp_cisco
Falsepositives:
  -Unlikely. Except due to misconfigurations
Level: low