Juniper BGP Logs: Missing MD5 Digest in Route Authentication

Flags Juniper BGP log messages indicating a missing MD5 digest, highlighting potential exposure from unauthenticated routing sessions.

FreeReviewedSigma · Low · v2

Product: juniper
Service: bgp
Author: Tim Brown (SigmaHQ), DRL 1.1
Published: 2023-01-09
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
Priv Esc
- T1078Valid Accounts
Defense Evasion
- T1078Valid Accounts
Cred Access
- T1110Brute Force
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags Juniper BGP log events that contain the protocol indicator and the text "missing MD5 digest." Missing MD5 authentication can allow attackers to attempt routing manipulation and related session abuse, so it is a meaningful configuration or security weakness. The detection relies on Juniper BGP telemetry where the log stream includes the relevant BGP marker and the "missing MD5 digest" message.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Cisco LDP MD5 Authentication Failure Events

Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks

Huawei BGP Authentication Failures Indicating Failed Session Attempts

Windows RDP Successful Logon (4624 LogonType 10) from Public IP

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Juniper BGP Logs: Missing MD5 Digest in Route Authentication

Pivot detection · T1110 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

juniper-bgp-missing-md5-digest-a7c0ae48

title: "Juniper BGP Logs: Missing MD5 Digest in Route Authentication"
id: 5faa9415-36f1-4662-8f93-ea9604d55303
status: test
description: This rule flags Juniper BGP log events that contain the protocol indicator and the text "missing MD5 digest." Missing MD5 authentication can allow attackers to attempt routing manipulation and related session abuse, so it is a meaningful configuration or security weakness. The detection relies on Juniper BGP telemetry where the log stream includes the relevant BGP marker and the "missing MD5 digest" message.
references:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/juniper/bgp/juniper_bgp_missing_md5.yml
author: Tim Brown, Huntrule Team
date: 2023-01-09
modified: 2023-01-23
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1078
  - attack.t1110
  - attack.t1557
logsource:
  product: juniper
  service: bgp
  definition: "Requirements: juniper bgp logs need to be enabled and ingested"
detection:
  keywords_bgp_juniper:
    "|all":
      - :179
      - missing MD5 digest
  condition: keywords_bgp_juniper
falsepositives:
  - Unlikely. Except due to misconfigurations
level: low
license: DRL-1.1
related:
  - id: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL