Analytics Story: Cisco Duo Suspicious Activity

Description

This analytics story focuses on identifying suspicious activities and potential account compromise events within environments protected by Duo multi-factor authentication (MFA). It provides detection rules and guidance to help security teams recognize signs of adversary tactics such as bypassing MFA, unauthorized access attempts, and other behaviors indicative of account takeover or credential abuse.

Why it matters

Multi-factor authentication (MFA) solutions like Duo are critical for protecting user accounts and sensitive resources from unauthorized access. However, attackers continue to develop techniques to circumvent or exploit MFA controls, including social engineering, phishing, and exploiting misconfigurations. This story brings together detections that highlight suspicious activity patterns in Duo-protected environments, such as users being set to bypass MFA, anomalous login attempts, and other indicators of account compromise. By leveraging these detections, security teams can quickly identify and respond to threats targeting authentication mechanisms, reducing the risk of successful account takeover and subsequent malicious activity.

Detections

Data Sources

References

• https://attack.mitre.org/techniques/T1586/
• https://www.imperva.com/learn/application-security/account-takeover-ato/
• https://www.barracuda.com/glossary/account-takeover
• https://www.okta.com/customer-identity/

Source: GitHub | Version: 1