Huawei BGP Authentication Failure Events

title: Huawei BGP Authentication Failure Events
id: 97c7ce86-db66-4607-8bf4-e88501e26abb
status: test
description: This rule identifies Huawei BGP log events indicating authentication failures, matching log content for the BGP protocol and the specific marker BGP_AUTH_FAILED. Repeated failures can signal an attacker attempting to compromise routing control or test credentials to disrupt or manipulate network paths. Telemetry required is Huawei BGP logs with event strings containing ":179" and "BGP_AUTH_FAILED".
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/huawei/bgp/huawei_bgp_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
modified: 2023-01-23
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: huawei
  service: bgp
  definition: "Requirements: huawei bgp logs need to be enabled and ingested"
detection:
  keywords_bgp_huawei:
    "|all":
      - :179
      - BGP_AUTH_FAILED
  condition: keywords_bgp_huawei
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: a557ffe6-ac54-43d2-ae69-158027082350
    type: derived