{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/cisco-duo/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cisco Duo"],"_cs_severities":["high"],"_cs_tags":["cisco-duo","account-compromise","unauthorized-access","ttp"],"_cs_type":"advisory","_cs_vendors":["Cisco"],"content_html":"\u003cp\u003eThis analytic focuses on identifying unusual administrative login activity within Cisco Duo environments. By monitoring Duo activity logs, it flags login attempts from operating systems that deviate from the norm, excluding common platforms like Mac OS X. The goal is to detect potential credential compromise or unauthorized access by threat actors utilizing unfamiliar devices. This method analyzes admin login actions, filters out logins from expected operating systems, aggregates events by browser, version, source IP, location, and OS details to highlight anomalies. The detection logic specifically looks for deviations from established patterns of administrative access, enabling security operations to quickly identify and respond to potentially malicious activities. This analytic uses data ingested via the Cisco Security Cloud App.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e The attacker gains access to a valid Duo admin username and password, potentially through phishing, credential stuffing, or other means.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthentication Request:\u003c/strong\u003e The attacker attempts to log in to the Duo admin panel using the compromised credentials.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDuo Authentication:\u003c/strong\u003e Duo prompts the attacker for secondary authentication (e.g., push notification, passcode).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBypass/Compromise MFA:\u003c/strong\u003e The attacker bypasses or compromises the MFA mechanism, possibly through social engineering, SIM swapping, or exploiting vulnerabilities.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAdmin Login:\u003c/strong\u003e The attacker successfully logs in to the Duo admin panel from an operating system not typically used by legitimate administrators.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivilege Escalation:\u003c/strong\u003e Once logged in, the attacker might attempt to escalate privileges or modify user permissions.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePolicy Changes:\u003c/strong\u003e The attacker could modify Duo policies to weaken security controls or bypass MFA requirements for other users.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement:\u003c/strong\u003e The attacker uses their access to pivot to other systems or applications integrated with Duo.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack could lead to unauthorized access to sensitive Duo configurations, potentially affecting the security of all applications and users protected by Duo. This can lead to widespread compromise, data breaches, and disruption of services. If an attacker successfully compromises a Duo admin account, they could disable MFA for targeted users, add new unauthorized users, or modify security policies to weaken the overall security posture.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the following Sigma rule to detect Duo admin logins from unusual operating systems and tune it for your specific environment.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule to determine the legitimacy of the login attempts.\u003c/li\u003e\n\u003cli\u003eMonitor Cisco Duo activity logs for any suspicious changes to user accounts, policies, or authentication methods using the Cisco Security Cloud App (\u003ca href=\"https://splunkbase.splunk.com/app/7404)\"\u003ehttps://splunkbase.splunk.com/app/7404)\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eImplement strong MFA policies and educate users about phishing and social engineering attacks.\u003c/li\u003e\n\u003cli\u003eReview and update Duo admin access controls to ensure only authorized personnel have access to administrative functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-cisco-duo-unusual-login/","summary":"Detection of Cisco Duo admin login attempts originating from operating systems not typically used in the environment, potentially indicating account compromise or unauthorized access.","title":"Cisco Duo Admin Login from Unusual Operating System","url":"https://feed.craftedsignal.io/briefs/2024-01-cisco-duo-unusual-login/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cisco Duo"],"_cs_severities":["medium"],"_cs_tags":["cisco-duo","credential-access","anomaly-detection"],"_cs_type":"advisory","_cs_vendors":["Cisco"],"content_html":"\u003cp\u003eThis analytic identifies instances of Cisco Duo administrators logging in using a web browser other than Chrome. The assumption is that most administrators within an organization consistently use Chrome, making other browsers anomalous. This detection is based on Cisco Duo activity logs ingested via the Cisco Security Cloud App. The activity logs are filtered for admin login events where the browser used is not Chrome. Detecting deviations from expected administrative access patterns can highlight potential security breaches such as credential compromise, session hijacking, or unauthorized device access. The scope of targeting is organizations using Cisco Duo for multi-factor authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains unauthorized access to a Duo administrator's credentials through phishing, malware, or social engineering.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the stolen credentials to initiate a login attempt to the Duo admin panel.\u003c/li\u003e\n\u003cli\u003eThe attacker uses a non-standard browser (e.g., Firefox, Safari, Edge) to access the Duo admin login page.\u003c/li\u003e\n\u003cli\u003eDuo activity logs record the admin login attempt, including the browser type, IP address, and geolocation data.\u003c/li\u003e\n\u003cli\u003eThe Splunk analytic identifies the login attempt as anomalous because the browser is not Chrome.\u003c/li\u003e\n\u003cli\u003eSecurity analysts investigate the alert and confirm unauthorized access.\u003c/li\u003e\n\u003cli\u003eThe attacker makes unauthorized changes to security policies, user access, or disables security controls within the Duo admin panel.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack could result in unauthorized modifications to security policies, user access, or the disabling of critical security controls. This can substantially weaken the organization's security posture, potentially leading to broader system compromises, data breaches, and service disruptions. The impact could range from targeted account takeovers to widespread privilege escalation affecting all users protected by Duo.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eCisco Duo Admin Login Unusual Browser\u003c/code\u003e to your SIEM to detect unusual browser usage for admin logins and tune for your specific environment.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule \u003ccode\u003eCisco Duo Admin Login Unusual Browser\u003c/code\u003e promptly to determine the legitimacy of the login attempt.\u003c/li\u003e\n\u003cli\u003eReview and reinforce security awareness training to prevent credential theft through phishing or other social engineering attacks.\u003c/li\u003e\n\u003cli\u003eMonitor the Duo activity logs for other suspicious activities, such as logins from unusual locations or at unusual times.\u003c/li\u003e\n\u003cli\u003eEnsure that the Cisco Security Cloud App is properly configured and ingesting Duo activity logs as described in the reference URL.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-cisco-duo-unusual-browser/","summary":"Detects Cisco Duo admin logins from browsers other than Chrome, potentially indicating compromised credentials, session hijacking, or unauthorized device usage.","title":"Cisco Duo Admin Login from Unusual Browser","url":"https://feed.craftedsignal.io/briefs/2024-01-03-cisco-duo-unusual-browser/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cisco Duo","Adobe Flash"],"_cs_severities":["medium"],"_cs_tags":["cisco_duo","policy_change","outdated_software"],"_cs_type":"advisory","_cs_vendors":["Cisco","Adobe"],"content_html":"\u003cp\u003eThis threat brief focuses on the potential weakening of security controls within Cisco Duo environments. Specifically, it addresses the scenario where a Duo administrator modifies or creates a policy to permit the use of outdated Adobe Flash components. This is identified through Duo activity logs by detecting policy changes with the attribute \u0026quot;flash_remediation=no remediation\u0026quot;. The scope of this threat involves any organization using Cisco Duo for multi-factor authentication and where Flash-based applications or services are still in use, despite Flash reaching end-of-life. This policy change can significantly broaden the attack surface, as outdated Flash versions are riddled with known security vulnerabilities. Attackers may exploit these weaknesses to bypass authentication controls, potentially leading to unauthorized access, malware deployment, or privilege escalation. Defenders should be aware of this as it can undermine the overall security posture of the organization and lead to compliance violations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a Cisco Duo administrator's account through compromised credentials or social engineering.\u003c/li\u003e\n\u003cli\u003eThe attacker logs into the Cisco Duo Admin Panel with the compromised administrator account.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the \u0026quot;Policies\u0026quot; section of the Duo Admin Panel.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies an existing policy or creates a new policy to allow the use of outdated Flash components by setting \u0026quot;flash_remediation=no remediation\u0026quot;.\u003c/li\u003e\n\u003cli\u003eThe policy change is saved, and the updated configuration is applied to the targeted users or applications.\u003c/li\u003e\n\u003cli\u003eA user with an outdated Flash version attempts to authenticate through Duo.\u003c/li\u003e\n\u003cli\u003eDue to the modified policy, the user is granted access despite the outdated Flash version.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the Flash vulnerability on the user's system to execute malicious code, potentially leading to data theft or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack leveraging a policy allowing outdated Flash in Cisco Duo can lead to several negative consequences. Attackers can bypass multi-factor authentication, gaining unauthorized access to sensitive systems and data. Depending on the targeted systems, this could result in data breaches, financial losses, and reputational damage. The impact is especially significant for organizations in regulated industries that require strict adherence to security compliance standards. The number of potential victims depends on the scope of the vulnerable policy and the number of users still relying on outdated Flash components.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eCisco Duo Policy Allowing Outdated Flash\u003c/code\u003e to detect instances where Duo administrators create or update policies to allow outdated Flash versions. This will provide real-time alerting of potentially malicious policy changes (rule).\u003c/li\u003e\n\u003cli\u003eReview all existing Cisco Duo policies and ensure that Flash remediation is enabled (\u0026quot;flash_remediation=remediation\u0026quot;) to prevent the exploitation of Flash vulnerabilities.\u003c/li\u003e\n\u003cli\u003eEnforce a policy of disabling or removing Flash from all endpoints where it is not absolutely necessary.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule to determine the intent behind the policy change and whether the administrator account was compromised.\u003c/li\u003e\n\u003cli\u003eMonitor Cisco Duo activity logs using the \u003ccode\u003ecisco_duo_administrator\u003c/code\u003e data source for suspicious activity patterns, such as unusual login times or policy changes made outside of normal business hours.\u003c/li\u003e\n\u003cli\u003eUtilize the Cisco Security Cloud App (referenced in the provided URL) to ingest Cisco Duo activity logs into your SIEM for centralized monitoring and analysis.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-02-cisco-duo-old-flash/","summary":"A Cisco Duo administrator may create or update a policy to allow the use of outdated Flash components, potentially increasing the attack surface by allowing exploitation of Flash vulnerabilities.","title":"Cisco Duo Policy Allowing Outdated Flash Usage","url":"https://feed.craftedsignal.io/briefs/2024-01-02-cisco-duo-old-flash/"}],"language":"en","title":"CraftedSignal Threat Feed - Cisco Duo","version":"https://jsonfeed.org/version/1.1"}