Cisco LDP MD5 Authentication Failure Events
Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.
- Product
- cisco
- Service
- ldp
- Author
- Tim Brown (SigmaHQ), DRL 1.1
- Published
- 2023-01-09
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Cisco LDP log events indicating TCP MD5 authentication failures, using the LDP protocol marker and the specific failure keywords. Authentication failures can signal repeated login attempts or brute-force activity aimed at interfering with MPLS label distribution. The detection relies on properly ingested Cisco LDP service telemetry containing the protocol identifier and the defined MD5 auth failure fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Cisco LDP MD5 Authentication Failure Events
id: ec72aac2-1f2e-4d8e-a4ab-d77adedb5a6d
status: test
description: This rule matches Cisco LDP log events indicating TCP MD5 authentication failures, using the LDP protocol marker and the specific failure keywords. Authentication failures can signal repeated login attempts or brute-force activity aimed at interfering with MPLS label distribution. The detection relies on properly ingested Cisco LDP service telemetry containing the protocol identifier and the defined MD5 auth failure fields.
references:
- https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
- attack.credential-access
- attack.collection
- attack.stealth
- attack.t1078
- attack.t1110
- attack.t1557
logsource:
product: cisco
service: ldp
definition: "Requirements: cisco ldp logs need to be enabled and ingested"
detection:
selection_protocol:
- LDP
selection_keywords:
- SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL
- TCPMD5AuthenFail
condition: selection_protocol and selection_keywords
falsepositives:
- Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
- id: 50e606bf-04ce-4ca7-9d54-3449494bbd4b
type: derived