Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code
Alert on Duo successful MFA logins that are attributed to bypass-user codes.
FreeReviewedSigma · Medium · v4
- Product
- cisco
- Service
- duo
- Author
- Nikita Khalimonenkov (SigmaHQ), DRL 1.1
- Published
- 2024-04-17
- Updated
- 2026-07-31
What it detects
This rule flags successful Duo MFA authentication events where the authentication reason indicates use of a bypass code for the user. Attackers or insiders could leverage bypass codes to complete MFA without the usual enrolled device flow, so correlating these successes helps identify potentially unauthorized access. The detection relies on Cisco Duo authentication telemetry fields indicating both the authentication event type and the bypass-code reason (e.g., bypass_user).
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
cisco-duo-mfa-successful-login-using-bypass-code-reason-bypass-user-6f7e1c10
title: Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code
id: 5fceeb44-df77-4fa5-8aad-1f0d0967a49e
status: test
description: This rule flags successful Duo MFA authentication events where the authentication reason indicates use of a bypass code for the user. Attackers or insiders could leverage bypass codes to complete MFA without the usual enrolled device flow, so correlating these successes helps identify potentially unauthorized access. The detection relies on Cisco Duo authentication telemetry fields indicating both the authentication event type and the bypass-code reason (e.g., bypass_user).
references:
- https://duo.com/docs/adminapi#logs
- https://help.duo.com/s/article/6327?language=en_US
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2024-04-17
tags:
- attack.credential-access
- attack.initial-access
- attack.stealth
logsource:
product: cisco
service: duo
detection:
selection:
event_type: authentication
reason: bypass_user
condition: selection
falsepositives:
- Legitimate user that was assigned on purpose to a bypass group
level: medium
license: DRL-1.1
related:
- id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8
type: derived