From 5b4bfd6ffd9462ba6ee4d9847cc9e67757d95238 Mon Sep 17 00:00:00 2001
From: nikitah4x <58976181+nikitah4x@users.noreply.github.com>
Date: Wed, 17 Apr 2024 13:28:38 +0300
Subject: [PATCH] Merge PR #4814 from @nikitah4x - Add new rule to detect MFA
 bypass in Cisco Duo

new: Cisco Duo Successful MFA Authentication Via Bypass Code

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
---
 .../cisco_duo_mfa_bypass_via_bypass_code.yml  | 26 +++++++++++++++++++
 tests/logsource.json                          |  1 +
 2 files changed, 27 insertions(+)
 create mode 100644 rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml

diff --git a/rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml b/rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml
new file mode 100644
index 000000000..16887e301
--- /dev/null
+++ b/rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml
@@ -0,0 +1,26 @@
+title: Cisco Duo Successful MFA Authentication Via Bypass Code
+id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8
+status: experimental
+description: |
+    Detects when a successful MFA authentication occurs due to the use of a bypass code.
+    A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
+references:
+    - https://duo.com/docs/adminapi#logs
+    - https://help.duo.com/s/article/6327?language=en_US
+author: Nikita Khalimonenkov
+date: 2024/04/17
+tags:
+    - attack.credential_access
+    - attack.defense_evasion
+    - attack.initial_access
+logsource:
+    product: cisco
+    service: duo
+detection:
+    selection:
+        event_type: authentication
+        reason: bypass_user
+    condition: selection
+falsepositives:
+    - Legitimate user that was assigned on purpose to a bypass group
+level: medium
diff --git a/tests/logsource.json b/tests/logsource.json
index 615da9d98..99cc71700 100644
--- a/tests/logsource.json
+++ b/tests/logsource.json
@@ -174,6 +174,7 @@
             "service":{
                 "aaa":[],
                 "bgp":[],
+                "duo":[],
                 "ldp":[],
                 "syslog":[]
             }