Juniper BGP Missing MD5

Title: Juniper BGP Missing MD5
Status: test
Description:Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
References:
  -https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Author: Tim Brown
Date: 2023-01-09
modified:2023-01-23
Tags:

• -'attack.initial-access'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.credential-access'
• -'attack.collection'
• -'attack.stealth'
• -'attack.t1078'
• -'attack.t1110'
• -'attack.t1557'

Logsource:

• product: juniper
• service: bgp
• definition: Requirements: juniper bgp logs need to be enabled and ingested

Detection:
  keywords_bgp_juniper:
    |all:
      -':179'
      -'missing MD5 digest'

  condition:keywords_bgp_juniper
Falsepositives:
  -Unlikely. Except due to misconfigurations
Level: low