Cisco Duo bypass code created by administrator

This rule is part of a beta feature. To learn more, contact Support.
cisco-duo

Classification:

attack

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a Duo bypass code is created by an administrator.

Strategy

This rule monitors Cisco Duo activity logs for the creation of bypass codes by administrators. A bypass code is a temporary passcode created by an administrator for a specific user. These are generally used as “backup codes” to grant enrolled users access to their Duo-protected systems when they have problems with their mobile device, or when they’re temporarily unable to access their enrolled device.

Triage and Response

  1. Investigate the nature of the bypass code creation:
    • Verify if the bypass code creation generated by user {{@usr.email}} from device IP {{@access_device.ip.address}} was authorized and legitimate.
    • Identify the administrator responsible for the action.
  2. If unauthorized or suspicious activity is detected:
    • Disable or review the administrator’s account.
    • Reset any affected user accounts associated with the bypass codes.
    • Initiate an investigation into potential security breaches.