Name:Cisco Duo Policy Allow Network Bypass 2FA id:2593f641-6192-4f3d-b96c-2bd1c706215f version:1 date:2025-07-09 author:Patrick Bareiss, Splunk status:production type:TTP Description:The following analytic detects when a Duo policy is created or updated to allow network-based bypass of two-factor authentication (2FA).
It identifies this behavior by searching Duo administrator logs for policy creation or update actions where the networks_allow field is present,
indicating that specific networks have been permitted to bypass 2FA requirements. This is achieved by parsing the event description and
filtering for relevant policy changes, then aggregating the results by user and administrator details. Detecting this behavior is critical
for a Security Operations Center (SOC) because allowing network-based 2FA bypass can significantly weaken authentication controls, potentially
enabling unauthorized access if a trusted network is compromised or misconfigured. Attackers or malicious insiders may exploit this policy
change to circumvent 2FA protections, increasing the risk of account takeover and lateral movement within the environment. Prompt detection
enables SOC analysts to investigate and respond to potentially risky policy modifications before they can be leveraged for malicious purposes.
Data_source:
-Cisco Duo Administrator
search:`cisco_duo_administrator` action=policy_update OR action=policy_create | spath input=description | search networks_allow=* | rename object as user | stats count min(_time) as firstTime max(_time) as lastTime by action actionlabel description user admin_email networks_allow | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_duo_policy_allow_network_bypass_2fa_filter`
how_to_implement:The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404). known_false_positives:unknown References: -https://splunkbase.splunk.com/app/7404 drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Cisco Duo Suspicious Activity' asset_type:Identity mitre_attack_id: - 'T1556' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' security_domain:identity
