Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code

title: Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code
id: 5fceeb44-df77-4fa5-8aad-1f0d0967a49e
status: test
description: This rule flags successful Duo MFA authentication events where the authentication reason indicates use of a bypass code for the user. Attackers or insiders could leverage bypass codes to complete MFA without the usual enrolled device flow, so correlating these successes helps identify potentially unauthorized access. The detection relies on Cisco Duo authentication telemetry fields indicating both the authentication event type and the bypass-code reason (e.g., bypass_user).
references:
  - https://duo.com/docs/adminapi#logs
  - https://help.duo.com/s/article/6327?language=en_US
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2024-04-17
tags:
  - attack.credential-access
  - attack.initial-access
  - attack.stealth
logsource:
  product: cisco
  service: duo
detection:
  selection:
    event_type: authentication
    reason: bypass_user
  condition: selection
falsepositives:
  - Legitimate user that was assigned on purpose to a bypass group
level: medium
license: DRL-1.1
related:
  - id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8
    type: derived