Duo - CraftedSignal Threat Feed

Cisco Duo Bulk Policy Deletion Detected

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This alert identifies instances where a Cisco Duo administrator deletes more than three policies in a single action. This behavior is detected by analyzing Duo activity logs for the policy_bulk_delete action. The analytic extracts the names of the deleted policies and counts them. If the count exceeds three, the event is flagged as suspicious. This bulk deletion of security policies can indicate malicious activity, such as an attacker or a rogue administrator attempting to weaken or disable security controls, potentially to facilitate unauthorized access or data breaches. Early detection is critical, as the impact could include a significantly reduced security posture and increased risk.

Attack Chain

An attacker gains administrative access to the Cisco Duo platform, either through compromised credentials or as a rogue insider.
The attacker authenticates to the Duo Admin Panel.
The attacker navigates to the "Policies" section within the Duo Admin Panel.
The attacker selects multiple policies (more than three) for deletion.
The attacker initiates the bulk deletion action, triggering the policy_bulk_delete event in the Duo activity logs.
The Cisco Duo system processes the deletion requests.
The targeted security policies are removed from the Duo configuration.
The attacker aims to weaken the overall security posture, making it easier to bypass authentication controls in the future.

Impact

A successful bulk policy deletion can severely compromise an organization's security posture. If critical MFA policies are deleted, unauthorized access to sensitive systems and data becomes easier. While specific victim counts are unavailable, the potential scope includes all users and systems protected by the deleted policies. The sectors most at risk are those heavily reliant on Duo for access control, including finance, healthcare, and government. Consequences range from data breaches and financial loss to regulatory penalties.

Recommendation

Deploy the Sigma rule Cisco Duo Bulk Policy Deletion to your SIEM to detect suspicious bulk policy deletions.
Investigate any alerts generated by the Cisco Duo Bulk Policy Deletion rule, focusing on the user account performing the deletions and the specific policies targeted.
Review and restrict Duo administrator privileges to minimize the risk of rogue insider activity.
Implement multi-factor authentication for all Duo administrator accounts to prevent unauthorized access.
Enable and regularly review audit logs within the Cisco Duo Admin Panel to monitor administrative actions.
Monitor Cisco Duo Administrator logs as the source of the Sigma rule.

Unusual Country for Cisco Duo Admin Login

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This analytic focuses on identifying suspicious admin logins to Cisco Duo accounts. The core concern is that if a Duo admin logs in from an unexpected geographic location, especially a country outside the United States, it could signal a compromised account or an insider threat. This activity warrants immediate investigation due to the elevated privileges associated with admin accounts. The detection logic analyzes Duo activity logs, specifically looking for "admin_login" events and filtering based on the originating country. The goal is to pinpoint login attempts that deviate from established patterns, which could indicate unauthorized access, potentially leading to a breach of Duo's security configurations and sensitive data. The analytic relies on the Cisco Security Cloud App to ingest Duo logs.

Attack Chain

The attacker gains unauthorized access to a Duo admin's credentials, possibly through phishing or credential stuffing.
The attacker uses the compromised credentials to attempt an admin login to the Duo platform.
Duo logs the admin login attempt, including the originating IP address and associated geolocation data.
The analytic ingests the Duo activity logs via the Cisco Security Cloud App.
The detection logic identifies the login attempt as originating from a country outside the United States.
The analytic correlates user, device, browser, and location information to confirm the anomalous login.
An alert is triggered, notifying security personnel of the suspicious admin login.
The attacker may then be able to bypass security controls, alter configurations, or exfiltrate sensitive information.

Impact

Successful exploitation could lead to complete compromise of the Duo security environment. An attacker with admin access could disable multi-factor authentication for targeted users, bypass security controls, modify security policies, or exfiltrate sensitive user data and configuration details. This could result in a significant data breach and disruption of services for organizations relying on Duo for authentication, potentially impacting thousands of users.

Recommendation

Deploy the Sigma rule provided in this brief to your SIEM to detect unusual admin logins based on geographic location and tune it to exclude known good logins from international travelers.
Investigate any alerts generated by the Sigma rule to determine the validity of the login attempt, correlating the event with other security logs for the user account.
Enable multi-factor authentication (MFA) on all Duo admin accounts to mitigate the risk of credential compromise.
Ingest Cisco Duo activity logs using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404) to enable the detection logic.

Cisco Duo User 2FA Bypass

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief addresses the risk associated with unauthorized modification of user status within Cisco Duo, specifically the act of setting a user's status to "Bypass" for 2FA after it was previously "Active". Such a change significantly weakens the security posture of the affected account and may be indicative of malicious insider activity or account compromise. Attackers or unauthorized administrators could exploit this capability to disable strong authentication controls, thereby increasing the risk of unauthorized access to sensitive systems and data. This activity is detected via the Cisco Duo activity logs. Early detection of such changes is critical for enabling rapid investigation and response, helping to prevent potential breaches and limit the impact of credential-based attacks.

Attack Chain

Initial Access: An attacker gains initial access through compromised credentials or insider access.
Privilege Escalation: The attacker escalates privileges to an account capable of modifying Duo user settings.
Configuration Change: The attacker navigates to the Cisco Duo admin panel and modifies the target user's status.
User Status Modification: The attacker changes the user's status from "Active" to "Bypass", effectively disabling 2FA for that account.
Authentication Bypass: The attacker uses the compromised credentials to authenticate to protected resources without 2FA.
Lateral Movement: The attacker leverages the access gained to move laterally within the network, accessing additional systems and data.
Data Exfiltration/Damage: The attacker exfiltrates sensitive data or causes damage to critical systems.

Impact

Successful exploitation can lead to a complete compromise of user accounts, enabling attackers to bypass multi-factor authentication and gain unauthorized access to sensitive systems and data. The impact can range from data breaches and financial loss to disruption of critical services. While the exact number of victims is not specified, any organization using Cisco Duo is potentially at risk. The sectors targeted are broad, as Duo is used across various industries to protect access to applications and resources.

Recommendation

Enable and monitor Cisco Duo activity logs to detect unauthorized changes (Cisco Duo Administrator).
Deploy the provided Sigma rule to detect instances where a user's status is changed to "Bypass" after being "Active" (Sigma rule: "Cisco Duo Set User Status to Bypass 2FA").
Investigate any alerts generated by the Sigma rule to determine the legitimacy of the user status change.
Implement strict access controls and multi-factor authentication for all administrative accounts in Cisco Duo.
Review and update user access privileges regularly to minimize the potential impact of compromised accounts.

Cisco Duo Policy Modification to Bypass 2FA for Specific Countries

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This analytic focuses on the detection of unauthorized modifications to Cisco Duo policies that could weaken an organization's security. Specifically, it identifies instances where a Duo policy is created or updated to permit access without two-factor authentication (2FA) for users originating from countries outside the default settings. This is significant because attackers or malicious insiders might exploit such policy changes to circumvent strong authentication controls. By monitoring the Duo administrator activity logs for policy creation or update actions where the policy description indicates that access is permitted without 2FA, defenders can quickly identify and respond to potentially malicious behavior. The scope of targeting is any organization utilizing Cisco Duo for multi-factor authentication.

Attack Chain

An attacker gains administrative access to the Cisco Duo administration panel, potentially through compromised credentials or exploiting a vulnerability.
The attacker navigates to the "Policies" section within the Duo admin panel.
The attacker creates a new policy or modifies an existing one.
Within the policy configuration, the attacker configures the "user_locations_default_action" setting to "Allow access without 2FA" for specific countries.
The attacker saves the policy changes, which are then logged as a policy_update or policy_create action in the Duo administrator activity logs.
Users from the targeted countries are now able to authenticate to systems protected by Duo without undergoing 2FA.
The attacker uses a compromised account originating from one of the allowed countries to gain initial access.
The attacker moves laterally within the network to access sensitive data or systems.

Impact

The impact of this attack includes unauthorized access to sensitive resources, data breaches, and potential lateral movement within the network. The absence of 2FA for specific countries significantly weakens the security posture, making it easier for attackers to compromise accounts and access valuable information. The number of affected users and systems depends on the scope of the policy change and the attacker's objectives.

Recommendation

Deploy the provided Sigma rule Cisco Duo Policy Created or Modified to Bypass 2FA to your SIEM and tune for your environment.
Investigate any alerts generated by the Sigma rule, focusing on the user and admin_email fields to identify potentially compromised administrator accounts.
Review all existing Duo policies to ensure that 2FA is enforced for all users, regardless of their location.
Implement multi-factor authentication for all administrator accounts to prevent unauthorized policy changes.
Monitor Cisco Duo Administrator logs for unusual activity patterns.
Regularly audit Duo policy configurations to identify and remediate any deviations from the established security baseline.

Cisco Duo Policy Bypass via 2FA Disablement

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat involves the modification of Cisco Duo policies to disable or bypass two-factor authentication (2FA). The attack leverages administrative access, either legitimate or compromised, to alter the Duo configuration. This manipulation allows unauthorized access to systems and applications normally protected by 2FA. This activity is identified by analyzing Cisco Duo administrator activity logs for policy changes that set the authentication status to "Allow access without 2FA". This is a critical issue because it significantly weakens the security posture of an organization, potentially leading to widespread compromise.

Attack Chain

The attacker gains access to a Cisco Duo administrator account, either through credential theft, social engineering, or exploiting a vulnerability.
The attacker logs into the Cisco Duo Admin Panel.
The attacker navigates to the "Policies" section within the Duo Admin Panel.
The attacker identifies a target policy to modify or creates a new policy.
The attacker modifies the policy settings, specifically changing the "Authentication Status" to "Allow access without 2FA."
The attacker saves the modified policy.
Users covered by the modified policy can now access protected applications and systems without completing 2FA.
The attacker exploits the lack of 2FA to gain unauthorized access to sensitive systems and data, potentially leading to data exfiltration, system compromise, or further lateral movement.

Impact

Successful exploitation allows attackers to bypass two-factor authentication, a critical security control. This can lead to unauthorized access to sensitive systems and data, potentially resulting in data breaches, financial loss, and reputational damage. The impact is widespread as any application or system protected by the affected Duo policy becomes vulnerable. The damage can be extensive, depending on the scope of access granted by the bypassed 2FA.

Recommendation

Deploy the Sigma rule Cisco Duo Policy Created Allowing 2FA Bypass to detect the creation of policies bypassing 2FA and tune for your environment.
Deploy the Sigma rule Cisco Duo Policy Updated Allowing 2FA Bypass to detect modifications of existing policies bypassing 2FA and tune for your environment.
Monitor Cisco Duo administrator activity logs for unauthorized or suspicious policy changes as described in the "Overview" section.
Review and enforce strong access controls for Cisco Duo administrator accounts, including multi-factor authentication, as this is the initial access vector.
Install the Cisco Security Cloud App from Splunkbase (https://splunkbase.splunk.com/app/7404) to ensure proper data ingestion from Cisco Duo.

Cisco Duo Policy Allowing Tampered Devices

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This analytic detects when a Duo policy is created or updated to allow tampered or rooted devices (e.g., jailbroken smartphones) to access protected resources. The detection focuses on changes to Duo policies where the allow_rooted_devices setting is enabled. The activity is identified through the examination of Cisco Duo administrator activity logs. This poses a significant security risk because tampered devices can bypass security controls, run unauthorized software, and become more susceptible to compromise. The ability to modify these settings can be indicative of a misconfiguration or a malicious attempt to weaken authentication requirements, potentially granting attackers access to sensitive systems using compromised devices.

Attack Chain

An attacker gains access to an administrative account within the Cisco Duo environment.
The attacker authenticates to the Duo Admin Panel.
The attacker navigates to the Policies section within the Duo Admin Panel.
The attacker modifies an existing policy or creates a new policy.
During policy creation or modification, the attacker enables the "Allow rooted devices" setting, which is represented as allow_rooted_devices=true in the policy description.
The Duo Admin Panel logs the policy creation or update event in the administrator activity logs.
Tampered devices are now able to authenticate via Duo and access protected resources.

Impact

A successful attack can lead to the circumvention of security controls on tampered devices, unauthorized access to sensitive systems, data breaches, and potential lateral movement within the network. Organizations relying on Duo for multi-factor authentication may experience a significant degradation in their security posture if this policy is enabled, potentially affecting thousands of users and devices.

Recommendation

Deploy the Sigma rule Cisco Duo Policy Allowing Tampered Devices to detect the creation or modification of Duo policies allowing tampered devices by monitoring the Duo administrator activity logs.
Review and audit existing Duo policies to identify any unintentional or malicious configurations allowing tampered devices.
Monitor the Cisco Duo Administrator logs for suspicious activity, especially related to policy changes.
Investigate any alerts triggered by the Sigma rule and remediate by reverting the policy change.

Cisco Duo Policy Allowing Outdated Java Usage

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief addresses the risk associated with modifying Cisco Duo policies to allow the use of outdated Java versions. An attacker, potentially an insider or an external actor who has compromised administrative credentials, weakens the organization's security posture by updating Duo policies to disable Java remediation. The activity is identified by monitoring Cisco Duo administrator activity logs for policy updates or creations where the java_remediation setting is explicitly set to no remediation. Allowing outdated Java exposes the organization to numerous security vulnerabilities, increasing the likelihood of successful exploitation. This activity could begin at any time, and defenders should consider the possibility of both malicious insiders and compromised accounts.

Attack Chain

Credential Compromise/Insider Threat: The attacker gains access to a Cisco Duo administrator account, either through credential compromise or by being a malicious insider.
Authentication: The attacker authenticates to the Cisco Duo administrative interface using the compromised or authorized account.
Policy Enumeration: The attacker enumerates existing Duo policies to identify potential targets for modification.
Policy Modification: The attacker modifies a Duo policy, specifically setting the java_remediation attribute to no remediation. This disables the enforcement of up-to-date Java requirements for applications protected by the modified policy.
Policy Activation: The modified policy is activated, allowing users with outdated Java versions to access protected applications without remediation prompts or blocks.
Vulnerability Exploitation: Users with outdated Java versions access protected applications, unknowingly creating an opportunity for attackers to exploit known Java vulnerabilities.
Lateral Movement/Data Breach: If a Java vulnerability is successfully exploited, the attacker may gain unauthorized access to systems, potentially leading to lateral movement within the network and/or data exfiltration.

Impact

The successful modification of Cisco Duo policies to allow outdated Java can have severe consequences. Victims can range from individual users to entire organizations. The immediate impact is a weakened security posture, increasing the organization's attack surface. Successful exploitation of Java vulnerabilities can lead to data breaches, system compromise, and potential financial losses. The number of affected users and systems depends on the scope of the modified policies and the prevalence of outdated Java versions within the organization.

Recommendation

Deploy the Sigma rule Cisco Duo Policy Allowing Old Java to detect policy updates that disable Java remediation based on cisco_duo_administrator logs.
Investigate any alerts generated by the Cisco Duo Policy Allowing Old Java Sigma rule, focusing on the user (user) and admin email (admin_email) associated with the policy change.
Review and enforce multi-factor authentication for all Cisco Duo administrator accounts to mitigate the risk of credential compromise.
Regularly audit Cisco Duo policies to ensure that Java remediation is enabled and aligned with security best practices.
Refer to the Cisco Security Cloud App documentation (https://splunkbase.splunk.com/app/7404) for proper log ingestion from Duo.

Cisco Duo Policy Change to Allow Devices Without Screen Lock

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This brief focuses on a Splunk detection analytic designed to identify the weakening of security controls within a Cisco Duo environment. Specifically, the analytic detects instances where a Duo policy is created or updated to permit devices without a screen lock requirement. This configuration change can expose organizations to increased security risks, as lost or stolen devices could be more easily compromised. The detection logic searches Cisco Duo administrator activity logs for policy creation or update events, explicitly looking for entries where the 'require_lock' setting is set to false. This activity is flagged because it deviates from a security best practice. This detection is critical for SOC teams, as malicious insiders or external attackers could attempt to lower authentication standards to facilitate unauthorized access.

Attack Chain

An attacker compromises an administrator account with privileges to modify Duo policies.
The attacker logs into the Duo Admin Panel using the compromised credentials.
The attacker navigates to the "Policies" section within the Duo Admin Panel.
The attacker either creates a new policy or modifies an existing policy.
Within the policy settings, the attacker modifies the "require_lock" setting to "false," allowing devices without screen locks to authenticate.
The attacker saves the policy changes.
Users with devices that do not have screen locks are now able to authenticate through Duo.
An attacker exploits a lost or stolen device without a screen lock to gain unauthorized access to protected resources.

Impact

Compromising Duo security policies to allow devices without screen locks significantly increases the risk of unauthorized access. If successful, this policy change could lead to credential compromise, data breaches, and lateral movement within the network. While the specific number of potential victims or targeted sectors is unknown, any organization using Cisco Duo for authentication is potentially vulnerable. The impact is magnified in environments where mobile devices are heavily used, or where sensitive data is accessed.

Recommendation

Deploy the provided Sigma rule to your SIEM and tune for your specific Cisco Duo environment to detect the policy change activity.
Review existing Duo policies to ensure that the "require_lock" setting is enabled for all appropriate policies and user groups.
Investigate any alerts generated by the Sigma rule by examining the Duo administrator activity logs and identifying the user (user field in the logs) who made the changes.
Monitor Cisco Duo administrator logs (cisco_duo_administrator data source) for unauthorized or suspicious activity.
Implement multi-factor authentication (MFA) for all administrative accounts, including those used to manage Duo policies, to prevent credential compromise.