Cisco Duo MFA Successful Login Using Bypass Code (reason: bypass_user)

title: "Cisco Duo MFA Successful Login Using Bypass Code (reason: bypass_user)"
id: 5fceeb44-df77-4fa5-8aad-1f0d0967a49e
status: test
description: This rule flags successful Duo MFA authentications where the authentication reason is recorded as a bypass code for the user. Attackers or misuse scenarios can leverage bypass/backup-style codes to complete MFA without using the enrolled device. The detection relies on Cisco Duo authentication events containing the event_type of authentication and a reason value of bypass_user.
references:
  - https://duo.com/docs/adminapi#logs
  - https://help.duo.com/s/article/6327?language=en_US
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2024-04-17
tags:
  - attack.credential-access
  - attack.initial-access
  - attack.stealth
logsource:
  product: cisco
  service: duo
detection:
  selection:
    event_type: authentication
    reason: bypass_user
  condition: selection
falsepositives:
  - Legitimate user that was assigned on purpose to a bypass group
level: medium
license: DRL-1.1
related:
  - id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8
    type: derived