Cisco LDP Authentication Failures Indicating TCP MD5 Auth Rejects

Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.

FreeUnreviewedSigmalowv1

cisco-ldp-authentication-failures-indicating-tcp-md5-auth-rejects-50e606bf

title: Cisco LDP Authentication Failures Indicating TCP MD5 Auth Rejects
id: ec72aac2-1f2e-4d8e-a4ab-d77adedb5a6d
status: test
description: This rule matches Cisco LDP log events indicating TCP MD5 authentication failures, specifically error keywords for failed LDP authentication. Repeated authentication failures can signal an attacker attempting to brute force or manipulate MPLS label signaling access. The detection relies on Cisco LDP telemetry containing LDP protocol markers and the TCP MD5 authentication failure keyword strings.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: cisco
  service: ldp
  definition: "Requirements: cisco ldp logs need to be enabled and ingested"
detection:
  selection_protocol:
    - LDP
  selection_keywords:
    - SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL
    - TCPMD5AuthenFail
  condition: selection_protocol and selection_keywords
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: 50e606bf-04ce-4ca7-9d54-3449494bbd4b
    type: derived

What it detects

This rule matches Cisco LDP log events indicating TCP MD5 authentication failures, specifically error keywords for failed LDP authentication. Repeated authentication failures can signal an attacker attempting to brute force or manipulate MPLS label signaling access. The detection relies on Cisco LDP telemetry containing LDP protocol markers and the TCP MD5 authentication failure keyword strings.

Known false positives

Unlikely. Except due to misconfigurations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.