Cisco LDP MD5 Authentication Failure Events

Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.

FreeReviewedSigma · Low · v2

Product: cisco
Service: ldp
Author: Tim Brown (SigmaHQ), DRL 1.1
Published: 2023-01-09
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
Priv Esc
- T1078Valid Accounts
Defense Evasion
- T1078Valid Accounts
Cred Access
- T1110Brute Force
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule matches Cisco LDP log events indicating TCP MD5 authentication failures, using the LDP protocol marker and the specific failure keywords. Authentication failures can signal repeated login attempts or brute-force activity aimed at interfering with MPLS label distribution. The detection relies on properly ingested Cisco LDP service telemetry containing the protocol identifier and the defined MD5 auth failure fields.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks

Huawei BGP Authentication Failures Indicating Failed Session Attempts

Juniper BGP Logs: Missing MD5 Digest in Route Authentication

Windows RDP Successful Logon (4624 LogonType 10) from Public IP

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Cisco LDP MD5 Authentication Failure Events

Pivot detection · T1110 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-ldp-authentication-failures-indicating-tcp-md5-auth-rejects-50e606bf

title: Cisco LDP MD5 Authentication Failure Events
id: ec72aac2-1f2e-4d8e-a4ab-d77adedb5a6d
status: test
description: This rule matches Cisco LDP log events indicating TCP MD5 authentication failures, using the LDP protocol marker and the specific failure keywords. Authentication failures can signal repeated login attempts or brute-force activity aimed at interfering with MPLS label distribution. The detection relies on properly ingested Cisco LDP service telemetry containing the protocol identifier and the defined MD5 auth failure fields.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: cisco
  service: ldp
  definition: "Requirements: cisco ldp logs need to be enabled and ingested"
detection:
  selection_protocol:
    - LDP
  selection_keywords:
    - SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL
    - TCPMD5AuthenFail
  condition: selection_protocol and selection_keywords
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: 50e606bf-04ce-4ca7-9d54-3449494bbd4b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL