Skip to content

Commit db45a47

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3602 from splunk/duo_detections_1
Cisco Duo Detections
2 parents 0329943 + e434b1a commit db45a47

19 files changed

+1066
-0
lines changed

‎data_sources/cisco_duo_activity.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Cisco Duo Activity
2+
id: 83f727f6-8754-41f8-b9f7-8226886a659e
3+
version: 1
4+
date: '2025-07-10'
5+
author: Patrick Bareiss, Splunk
6+
description: Data source object for Cisco Duo Activity
7+
source: cisco_duo
8+
sourcetype: cisco:duo:activity
9+
separator: null
10+
supported_TA:
11+
- name: Cisco Security Cloud
12+
url: https://splunkbase.splunk.com/app/7404
13+
version: 3.2.3
14+
fields:
15+
- access_device.browser
16+
- access_device.browser_version
17+
- access_device.ip.address
18+
- access_device.location.city
19+
- access_device.location.country
20+
- access_device.location.state
21+
- access_device.os
22+
- access_device.os_version
23+
- action.details
24+
- action.name
25+
- activity_id
26+
- actor.details
27+
- actor.key
28+
- actor.name
29+
- actor.type
30+
- akey
31+
- application
32+
- ctime
33+
- eventtype
34+
- extracted_eventtype
35+
- old_target
36+
- outcome.result
37+
- target.details
38+
- target.key
39+
- target.name
40+
- target.type
41+
- ts
42+
output_fields:
43+
- user
44+
- src_ip
45+
example_log: '{"ctime": "Thu Jul 10 07:37:49 2025", "access_device": {"browser": "Chrome", "browser_version": "137.0.0.0", "ip": {"address": "1.2.3.4"}, "location": {"city": "San Jose", "country": "United States", "state": "California"}, "os": "Windows", "os_version": "11"}, "action": {"details": "{\"auth_method\": \"Password\", \"auth_device\": \"WAPF4P9AJ344ZX3DGPNO\", \"factor\": \"webauthn\", \"role\": \"Owner\"}", "name": "admin_login"}, "activity_id": "e9b8d7eb-f274-4250-8f52-d0bee46b8abc", "actor": {"details": "{\"created\": \"2025-07-02T09:18:46.000000+00:00\", \"last_login\": \"2025-07-10T07:37:33.000000+00:00\", \"email\": \"[email protected]\", \"status\": null, \"groups\": null}", "key": "DEKXVXLFZBK5U0C9F1ST", "name": "Test Test", "type": "admin"}, "akey": "DAYQ46XVNT0NKTYQ5L5O", "application": null, "old_target": null, "outcome": {"result": "SUCCESS"}, "target": {"details": null, "key": null, "name": null, "type": "admin_login"}, "ts": "2025-07-10T07:37:49.616714+00:00", "timestamp": 1752133069, "host": "api-41e72ada.duosecurity.com", "extracted_eventtype": "activity"}'

‎data_sources/cisco_duo_administrator.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Cisco Duo Administrator
2+
id: 38e22de6-8b6b-449c-ae26-a640c88ff7f9
3+
version: 1
4+
date: '2025-07-10'
5+
author: Patrick Bareiss, Splunk
6+
description: Data source object for Cisco Duo Administrator
7+
source: cisco_duo
8+
sourcetype: cisco:duo:administrator
9+
separator: null
10+
supported_TA:
11+
- name: Cisco Security Cloud
12+
url: https://splunkbase.splunk.com/app/7404
13+
version: 3.2.3
14+
fields:
15+
- action
16+
- actionlabel
17+
- ctime
18+
- description
19+
- eventtype
20+
- extracted_eventtype
21+
- isotimestamp
22+
- object
23+
- timestamp
24+
- username
25+
output_fields:
26+
- user
27+
example_log: '{"ctime": "Tue Jul 8 12:28:47 2025", "action": "policy_create", "description": "{\"enroll_policy\": \"Allow Access\", \"name\": \"test4\", \"pretty_trusted_devices\": \"\", \"admin_email\": \"[email protected]\"}", "isotimestamp": "2025-07-08T12:28:47+00:00", "object": "test4", "timestamp": 1751977727, "username": "Test Test", "host": "api-41e72ada.duosecurity.com", "extracted_eventtype": "administrator", "actionlabel": "Added policy"}'

‎detections/application/cisco_duo_admin_login_unusual_browser.yml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Cisco Duo Admin Login Unusual Browser
2+
id: b38932ad-e663-4e90-bfdf-8446ee5b3f34
3+
version: 1
4+
date: '2025-07-10'
5+
author: Patrick Bareiss, Splunk
6+
data_source:
7+
- Cisco Duo Activity
8+
type: TTP
9+
status: production
10+
description: The following analytic identifies instances where a Duo admin logs in using a browser other than Chrome, which is considered unusual
11+
based on typical access patterns. Please adjust as needed to your environment. The detection leverages Duo activity logs ingested via the Cisco
12+
Security Cloud App and filters for admin login actions where the browser is not Chrome. By renaming and aggregating relevant fields such as user,
13+
browser, IP address, and location, the analytic highlights potentially suspicious access attempts that deviate from the norm. This behavior is
14+
significant for a SOC because the use of an unexpected browser may indicate credential compromise, session hijacking, or the use of unauthorized
15+
devices by attackers attempting to evade detection. Detecting such anomalies enables early investigation and response, helping to prevent privilege
16+
escalation, policy manipulation, or further compromise of sensitive administrative accounts. The impact of this attack could include unauthorized
17+
changes to security policies, user access, or the disabling of critical security controls, posing a substantial risk to the organizations security posture.
18+
search: '`cisco_duo_activity` "action.name"=admin_login NOT access_device.browser IN (Chrome)
19+
| rename actor.name as user access_device.ip.address as src_ip
20+
| stats count min(_time) as firstTime max(_time) as lastTime by access_device.browser
21+
access_device.browser_version src_ip access_device.location.city
22+
access_device.location.country access_device.location.state access_device.os access_device.os_version
23+
actor.details actor.type outcome.result user
24+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
25+
| `cisco_duo_admin_login_unusual_browser_filter`'
26+
how_to_implement: The analytic leverages Duo activity logs to be ingested using the
27+
Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
28+
known_false_positives: unknown
29+
references:
30+
- https://splunkbase.splunk.com/app/7404
31+
drilldown_searches:
32+
- name: View the detection results for - "$user$"
33+
search: '%original_detection_search% | search user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$user$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
38+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
39+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
40+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
41+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
42+
| `security_content_ctime(lastTime)`'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
rba:
46+
message: A user $user$ has logged in using an unusual browser $access_device.browser$ from $src_ip$.
47+
risk_objects:
48+
- field: user
49+
type: user
50+
score: 48
51+
threat_objects:
52+
- field: access_device.browser
53+
type: http_user_agent
54+
- field: src_ip
55+
type: ip_address
56+
tags:
57+
analytic_story:
58+
- Cisco Duo Suspicious Activity
59+
asset_type: Identity
60+
mitre_attack_id:
61+
- T1556
62+
product:
63+
- Splunk Enterprise
64+
- Splunk Enterprise Security
65+
- Splunk Cloud
66+
security_domain: identity
67+
tests:
68+
- name: True Positive Test
69+
attack_data:
70+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity.json
71+
source: duo
72+
sourcetype: cisco:duo:activity

‎detections/application/cisco_duo_admin_login_unusual_country.yml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Cisco Duo Admin Login Unusual Country
2+
id: 1bf631d1-44a0-472b-98c4-2975b8b281df
3+
version: 1
4+
date: '2025-07-10'
5+
author: Patrick Bareiss, Splunk
6+
data_source:
7+
- Cisco Duo Activity
8+
type: TTP
9+
status: production
10+
description: The following analytic detects instances where a Duo admin login originates from a country outside of the United States,
11+
which may indicate suspicious or unauthorized access attempts. Please adjust as needed to your environment. It works by analyzing Duo activity logs
12+
for admin login actions and filtering out events where the access device's country is not within the expected region. By correlating user, device,
13+
browser, and location details, the analytic highlights anomalies in geographic login patterns. This behavior is critical for a SOC to identify because
14+
admin accounts have elevated privileges, and access from unusual countries can be a strong indicator of credential compromise, account takeover,
15+
or targeted attacks. Early detection of such activity enables rapid investigation and response, reducing the risk of unauthorized changes, data breaches,
16+
or further lateral movement within the environment. The impact of this attack can be severe, potentially allowing attackers to bypass security controls,
17+
alter configurations, or exfiltrate sensitive information.
18+
search: '`cisco_duo_activity` "action.name"=admin_login NOT access_device.location.country IN ("United States")
19+
| rename actor.name as user access_device.ip.address as src_ip
20+
| stats count min(_time) as firstTime max(_time) as lastTime by access_device.browser
21+
access_device.browser_version src_ip access_device.location.city
22+
access_device.location.country access_device.location.state access_device.os access_device.os_version
23+
actor.details actor.type outcome.result user
24+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
25+
| `cisco_duo_admin_login_unusual_country_filter`'
26+
how_to_implement: The analytic leverages Duo activity logs to be ingested using the
27+
Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
28+
known_false_positives: unknown
29+
references:
30+
- https://splunkbase.splunk.com/app/7404
31+
drilldown_searches:
32+
- name: View the detection results for - "$user$"
33+
search: '%original_detection_search% | search user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$user$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
38+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
39+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
40+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
41+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
42+
| `security_content_ctime(lastTime)`'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
rba:
46+
message: A user $user$ has logged in using an unusual country using browser $access_device.browser$ from $src_ip$.
47+
risk_objects:
48+
- field: user
49+
type: user
50+
score: 48
51+
threat_objects:
52+
- field: access_device.browser
53+
type: http_user_agent
54+
- field: src_ip
55+
type: ip_address
56+
tags:
57+
analytic_story:
58+
- Cisco Duo Suspicious Activity
59+
asset_type: Identity
60+
mitre_attack_id:
61+
- T1556
62+
product:
63+
- Splunk Enterprise
64+
- Splunk Enterprise Security
65+
- Splunk Cloud
66+
security_domain: identity
67+
tests:
68+
- name: True Positive Test
69+
attack_data:
70+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity.json
71+
source: duo
72+
sourcetype: cisco:duo:activity

‎detections/application/cisco_duo_admin_login_unusual_os.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Cisco Duo Admin Login Unusual Os
2+
id: c4824cc6-d644-458e-a39a-67cd67da75e3
3+
version: 1
4+
date: '2025-07-10'
5+
author: Patrick Bareiss, Splunk
6+
data_source:
7+
- Cisco Duo Activity
8+
type: TTP
9+
status: production
10+
description: The following analytic identifies Duo admin login attempts from operating systems that are unusual for your environment, excluding commonly
11+
used OS such as Mac OS X. Please adjust to your environment. It works by analyzing Duo activity logs for admin login actions and filtering out logins
12+
from expected operating systems. The analytic then aggregates events by browser, version, source IP, location, and OS details to highlight anomalies.
13+
Detecting admin logins from unexpected operating systems is critical for a SOC, as it may indicate credential compromise, unauthorized access, or
14+
attacker activity using unfamiliar devices. Such behavior can precede privilege escalation, policy changes, or other malicious actions within the
15+
Duo environment. Early detection enables rapid investigation and response, reducing the risk of account takeover and minimizing potential damage
16+
to organizational security controls.
17+
search: '`cisco_duo_activity` "action.name"=admin_login NOT access_device.os IN ("Mac OS X")
18+
| rename actor.name as user access_device.ip.address as src_ip
19+
| stats count min(_time) as firstTime max(_time) as lastTime by access_device.browser
20+
access_device.browser_version src_ip access_device.location.city
21+
access_device.location.country access_device.location.state access_device.os access_device.os_version
22+
actor.details actor.type outcome.result user
23+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
24+
| `cisco_duo_admin_login_unusual_os_filter`'
25+
how_to_implement: The analytic leverages Duo activity logs to be ingested using the
26+
Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
27+
known_false_positives: unknown
28+
references:
29+
- https://splunkbase.splunk.com/app/7404
30+
drilldown_searches:
31+
- name: View the detection results for - "$user$"
32+
search: '%original_detection_search% | search user = "$user$"'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: View risk events for the last 7 days for - "$user$"
36+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
37+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
38+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
39+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
40+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
41+
| `security_content_ctime(lastTime)`'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
rba:
45+
message: A user $user$ has logged in using an unusual OS $access_device.os$ using browser $access_device.browser$ from $src_ip$.
46+
risk_objects:
47+
- field: user
48+
type: user
49+
score: 48
50+
threat_objects:
51+
- field: access_device.browser
52+
type: http_user_agent
53+
- field: src_ip
54+
type: ip_address
55+
tags:
56+
analytic_story:
57+
- Cisco Duo Suspicious Activity
58+
asset_type: Identity
59+
mitre_attack_id:
60+
- T1556
61+
product:
62+
- Splunk Enterprise
63+
- Splunk Enterprise Security
64+
- Splunk Cloud
65+
security_domain: identity
66+
tests:
67+
- name: True Positive Test
68+
attack_data:
69+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity.json
70+
source: duo
71+
sourcetype: cisco:duo:activity

‎detections/application/cisco_duo_bulk_policy_deletion.yml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Cisco Duo Bulk Policy Deletion
2+
id: 983be012-e408-4cb0-b87f-6756bb5f7047
3+
version: 1
4+
date: '2025-07-10'
5+
author: Patrick Bareiss, Splunk
6+
data_source:
7+
- Cisco Duo Administrator
8+
type: TTP
9+
status: production
10+
description: The following analytic detects instances where a Duo administrator performs a bulk deletion of more than three policies in a single action.
11+
It identifies this behavior by searching Duo activity logs for the policy_bulk_delete action, extracting the names of deleted policies, and counting
12+
them. If the count exceeds three, the event is flagged. This behavior is significant for a Security Operations Center (SOC) because mass deletion of
13+
security policies can indicate malicious activity, such as an attacker or rogue administrator attempting to weaken or disable security controls,
14+
potentially paving the way for further compromise. Detecting and investigating such actions promptly is critical, as the impact of this attack could
15+
include reduced security posture, increased risk of unauthorized access, and potential data breaches. Monitoring for bulk policy deletions helps ensure
16+
that any suspicious or unauthorized changes to security configurations are quickly identified and addressed to protect organizational assets and maintain
17+
compliance.
18+
search: '`cisco_duo_administrator` action=policy_bulk_delete
19+
| rename username as user
20+
| spath input=description
21+
| rex field=policies max_match=0 "(?<policy_name>[^:,]+):\s+"
22+
| eval policy_count=mvcount(policy_name)
23+
| where policy_count > 3
24+
| stats count min(_time) as firstTime max(_time) as lastTime by action actionlabel description user admin_email policy_count
25+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
26+
| `cisco_duo_bulk_policy_deletion_filter`'
27+
how_to_implement: The analytic leverages Duo activity logs to be ingested using the
28+
Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
29+
known_false_positives: unknown
30+
references:
31+
- https://splunkbase.splunk.com/app/7404
32+
drilldown_searches:
33+
- name: View the detection results for - "$user$"
34+
search: '%original_detection_search% | search user = "$user$"'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
- name: View risk events for the last 7 days for - "$user$"
38+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
39+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
40+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
41+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
42+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
43+
| `security_content_ctime(lastTime)`'
44+
earliest_offset: $info_min_time$
45+
latest_offset: $info_max_time$
46+
rba:
47+
message: A user $user$ has deleted more than 3 policies
48+
risk_objects:
49+
- field: user
50+
type: user
51+
score: 48
52+
threat_objects: []
53+
tags:
54+
analytic_story:
55+
- Cisco Duo Suspicious Activity
56+
asset_type: Identity
57+
mitre_attack_id:
58+
- T1556
59+
product:
60+
- Splunk Enterprise
61+
- Splunk Enterprise Security
62+
- Splunk Cloud
63+
security_domain: identity
64+
tests:
65+
- name: True Positive Test
66+
attack_data:
67+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/cisco_duo_administrator.json
68+
source: duo
69+
sourcetype: cisco:duo:administrator

0 commit comments

Comments
 (0)