Huawei BGP Authentication Failures Indicating Failed Session Attempts

Flags Huawei BGP authentication failure log events that may indicate credential attempts or routing manipulation.

FreeReviewedSigma · Low · v2

Product: huawei
Service: bgp
Author: Tim Brown (SigmaHQ), DRL 1.1
Published: 2023-01-09
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
Priv Esc
- T1078Valid Accounts
Defense Evasion
- T1078Valid Accounts
Cred Access
- T1110Brute Force
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags Huawei BGP log events containing the ':179' protocol marker and the message 'BGP_AUTH_FAILED'. Repeated authentication failures can indicate an attacker attempting to disrupt or gain access to BGP sessions to influence network routing. Detection relies on Huawei BGP log telemetry with specific authentication-failure text.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange

Cisco LDP MD5 Authentication Failure Events

Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks

Juniper BGP Logs: Missing MD5 Digest in Route Authentication

Windows RDP Successful Logon (4624 LogonType 10) from Public IP

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Suspicious Tycoon 2FA Phishing Script Retrieval

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious SSH Daemon Configuration Change Enabling Root Login

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

Huawei BGP Authentication Failures Indicating Failed Session Attempts

Pivot detection · T1078 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

huawei-bgp-authentication-failure-events-a557ffe6

title: Huawei BGP Authentication Failures Indicating Failed Session Attempts
id: 97c7ce86-db66-4607-8bf4-e88501e26abb
status: test
description: This rule flags Huawei BGP log events containing the ':179' protocol marker and the message 'BGP_AUTH_FAILED'. Repeated authentication failures can indicate an attacker attempting to disrupt or gain access to BGP sessions to influence network routing. Detection relies on Huawei BGP log telemetry with specific authentication-failure text.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/huawei/bgp/huawei_bgp_auth_failed.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
modified: 2023-01-23
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: huawei
  service: bgp
  definition: "Requirements: huawei bgp logs need to be enabled and ingested"
detection:
  keywords_bgp_huawei:
    "|all":
      - :179
      - BGP_AUTH_FAILED
  condition: keywords_bgp_huawei
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: a557ffe6-ac54-43d2-ae69-158027082350
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL