Juniper BGP Missing MD5 Digest

title: Juniper BGP Missing MD5 Digest
id: 5faa9415-36f1-4662-8f93-ea9604d55303
status: test
description: This rule matches Juniper BGP log entries that report a missing MD5 digest. Missing BGP session authentication can allow an attacker to attempt routing manipulation through unauthorized or weaker session establishment. It relies on the presence of BGP protocol log messages containing the specific text indicating the MD5 digest is absent.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/juniper/bgp/juniper_bgp_missing_md5.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
modified: 2023-01-23
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: juniper
  service: bgp
  definition: "Requirements: juniper bgp logs need to be enabled and ingested"
detection:
  keywords_bgp_juniper:
    "|all":
      - :179
      - missing MD5 digest
  condition: keywords_bgp_juniper
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
    type: derived