Name:Cisco Duo Set User Status to Bypass 2FA id:8728d224-9cd5-4aa7-b75f-f8520a569979 version:6 date:None author:Patrick Bareiss, Splunk status:production type:TTP Description:The following analytic detects instances where a Duo user's status is changed to "Bypass" for 2FA, specifically when the
previous status was "Active." This behavior is identified by analyzing Duo activity logs for user update actions, extracting
the status transitions, and filtering for cases where a user is set to bypass multi-factor authentication. This is a critical
event for a Security Operations Center (SOC) to monitor, as bypassing 2FA significantly weakens account security and may
indicate malicious insider activity or account compromise. Attackers or unauthorized administrators may exploit this change to
disable strong authentication controls, increasing the risk of unauthorized access to sensitive systems and data. Early detection
of such changes enables rapid investigation and response, helping to prevent potential breaches and limit the impact of
credential-based attacks.
Data_source:
how_to_implement:The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404). known_false_positives:No false positives have been identified at this time. References: -https://splunkbase.splunk.com/app/7404 drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Duo Suspicious Activity']
