Huawei BGP Authentication Failures

Title: Huawei BGP Authentication Failures
Status: test
Description:Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
References:
  -https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Author: Tim Brown
Date: 2023-01-09
modified:2023-01-23
Tags:

• -'attack.initial-access'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.credential-access'
• -'attack.collection'
• -'attack.stealth'
• -'attack.t1078'
• -'attack.t1110'
• -'attack.t1557'

Logsource:

• product: huawei
• service: bgp
• definition: Requirements: huawei bgp logs need to be enabled and ingested

Detection:
  keywords_bgp_huawei:
    |all:
      -':179'
      -'BGP_AUTH_FAILED'

  condition:keywords_bgp_huawei
Falsepositives:
  -Unlikely. Except due to misconfigurations
Level: low