heroui logo

Juniper BGP Missing MD5

Sigma Rules

View Source
Summary
This detection rule is designed to identify instances where Juniper BGP communications lack an MD5 digest, which is critical to ensuring the integrity and authenticity of the routing information being exchanged. A missing MD5 digest can indicate that brute force attacks are being attempted to manipulate routing protocols. Given the importance of secure BGP sessions, the absence of this security feature could leave the network vulnerable to various attacks, including route hijacking and route leaks. The rule utilizes Juniper-specific BGP logs which must be enabled and ingested for effective monitoring. When the specified keywords related to BGP communications are detected, it triggers an alert, allowing for further investigation into potential unauthorized access or malicious activities on the network.
Categories
  • Network
  • Cloud
  • Infrastructure
Data Sources
  • Network Traffic
  • Process
Created: 2023-01-09