Cisco Duo Successful MFA Authentication Via Bypass Code

calendar Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.initial-access  ·
Share on: linkedin copy

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Sigma rule (View on GitHub)

 1title: Cisco Duo Successful MFA Authentication Via Bypass Code
 2id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8
 3status: experimental
 4description: |
 5    Detects when a successful MFA authentication occurs due to the use of a bypass code.
 6    A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.    
 7references:
 8    - https://duo.com/docs/adminapi#logs
 9    - https://help.duo.com/s/article/6327?language=en_US
10author: Nikita Khalimonenkov
11date: 2024-04-17
12tags:
13    - attack.credential-access
14    - attack.defense-evasion
15    - attack.initial-access
16logsource:
17    product: cisco
18    service: duo
19detection:
20    selection:
21        event_type: authentication
22        reason: bypass_user
23    condition: selection
24falsepositives:
25    - Legitimate user that was assigned on purpose to a bypass group
26level: medium

References

Related rules

to-top