Sigma rule: Cisco Duo Successful MFA Authentication Via Bypass Code

Rule

Title

Cisco Duo Successful MFA Authentication Via Bypass Code

Status

test

Level

medium

Author

Nikita Khalimonenkov

Date

2024-04-17

File

rules/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a successful MFA authentication occurs due to the use of a bypass code.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Log source

product

cisco

service

duo

Detection

selection:
    event_type: authentication
    reason: bypass_user
condition: selection

False positives (as the rule lists them)

• Legitimate user that was assigned on purpose to a bypass group

Tags

• attack.credential-access
• attack.initial-access
• attack.stealth

References

• https://duo.com/docs/adminapi#logs
• https://help.duo.com/s/article/6327?language=en_US

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml