Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks

Flags Cisco BGP authentication failure events associated with TCP/179 traffic that may indicate credential abuse.

FreeReviewedSigma · Low · v2

Product: cisco
Service: bgp
Author: Tim Brown (SigmaHQ), DRL 1.1
Published: 2023-01-09
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
Priv Esc
- T1078Valid Accounts
Defense Evasion
- T1078Valid Accounts
Cred Access
- T1110Brute Force
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule matches Cisco BGP log events tagged with TCP port 179 protocol activity and the specific BGP message “IP-TCP-3-BADAUTH,” which indicates BGP authentication failures. Attackers may trigger repeated authentication failures to probe credentials or disrupt routing to enable downstream access or persistence. It relies on Cisco BGP logs that include the protocol indicator for port 179 and the BADAUTH error text.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Cisco LDP MD5 Authentication Failure Events

Huawei BGP Authentication Failures Indicating Failed Session Attempts

Juniper BGP Logs: Missing MD5 Digest in Route Authentication

Windows RDP Successful Logon (4624 LogonType 10) from Public IP

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks

Pivot detection · T1110 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-bgp-authentication-failures-on-tcp-179-56fa3cd6

title: Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks
id: 35bb27f8-0acc-428a-98f1-da2cf9d7c879
status: test
description: This rule matches Cisco BGP log events tagged with TCP port 179 protocol activity and the specific BGP message “IP-TCP-3-BADAUTH,” which indicates BGP authentication failures. Attackers may trigger repeated authentication failures to probe credentials or disrupt routing to enable downstream access or persistence. It relies on Cisco BGP logs that include the protocol indicator for port 179 and the BADAUTH error text.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
modified: 2023-01-23
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: cisco
  service: bgp
  definition: "Requirements: cisco bgp logs need to be enabled and ingested"
detection:
  keywords_bgp_cisco:
    "|all":
      - :179
      - IP-TCP-3-BADAUTH
  condition: keywords_bgp_cisco
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: 56fa3cd6-f8d6-4520-a8c7-607292971886
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL