Cisco BGP Authentication Failures on TCP/179

Flags Cisco BGP authentication failure events associated with TCP/179 traffic that may indicate credential abuse.

FreeUnreviewedSigmalowv1

cisco-bgp-authentication-failures-on-tcp-179-56fa3cd6

title: Cisco BGP Authentication Failures on TCP/179
id: 35bb27f8-0acc-428a-98f1-da2cf9d7c879
status: test
description: This rule matches Cisco BGP log entries indicating protocol traffic on TCP port 179 with the BGP authentication failure message. Such failures can signal repeated invalid BGP credentials, which attackers may use to disrupt or manipulate routing behavior. It relies on Cisco BGP service telemetry containing the specific protocol and authentication failure indicators.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
modified: 2023-01-23
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: cisco
  service: bgp
  definition: "Requirements: cisco bgp logs need to be enabled and ingested"
detection:
  keywords_bgp_cisco:
    "|all":
      - :179
      - IP-TCP-3-BADAUTH
  condition: keywords_bgp_cisco
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: 56fa3cd6-f8d6-4520-a8c7-607292971886
    type: derived

What it detects

This rule matches Cisco BGP log entries indicating protocol traffic on TCP port 179 with the BGP authentication failure message. Such failures can signal repeated invalid BGP credentials, which attackers may use to disrupt or manipulate routing behavior. It relies on Cisco BGP service telemetry containing the specific protocol and authentication failure indicators.

Known false positives

Unlikely. Except due to misconfigurations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.