Duo Admin User MFA Bypass Enabled

Description

An Administrator enabled a user to authenticate without MFA.

Query · python

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "user_update":
        description = deserialize_administrator_log_event_description(event)
        if "status" in description:
            return description.get("status") == "Bypass"
    return False


def title(event):
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        f"updated account [{event.get('object', '<object_not_found>')}] "
        "to not require two-factor authentication."
    )


def alert_context(event):
    return duo_alert_context(event)
Raw source Duo Admin User MFA Bypass Enabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: An Administrator enabled a user to authenticate without MFA.
DisplayName: "Duo Admin User MFA Bypass Enabled"
Enabled: true
Filename: duo_admin_user_mfa_bypass_enabled.py
Reference: https://duo.com/docs/policy#authentication-policy
Severity: Medium
Tests:
  - ExpectedResult: false
    Log:
      action: user_update
      description: '{"status": "Active"}'
      isotimestamp: "2021-10-05 22:45:33"
      object: bart.simpson@simpsons.com
      timestamp: "2021-10-05 22:45:33"
      username: Homer Simpson
    Name: Account Active
  - ExpectedResult: false
    Log:
      action: user_update
      description: '{"status": "Disabled"}'
      isotimestamp: "2021-10-05 22:45:33"
      object: bart.simpson@simpsons.com
      timestamp: "2021-10-05 22:45:33"
      username: Homer Simpson
    Name: Account Disabled
  - ExpectedResult: true
    Log:
      action: user_update
      description: '{"status": "Bypass"}'
      isotimestamp: "2021-10-05 22:45:33"
      object: bart.simpson@simpsons.com
      timestamp: "2021-10-05 22:45:33"
      username: Homer Simpson
    Name: Bypass Enabled
  - ExpectedResult: false
    Log:
      action: user_update
      description: '{"phones": ""}'
      isotimestamp: "2021-07-02 19:06:40"
      object: homer.simpson@simpsons.com
      timestamp: "2021-07-02 19:06:40"
      username: Homer Simpson
    Name: Phones Update
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.User.MFA.Bypass.Enabled"
Threshold: 1


# ------ paired body: duo_admin_user_mfa_bypass_enabled.py ------

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "user_update":
        description = deserialize_administrator_log_event_description(event)
        if "status" in description:
            return description.get("status") == "Bypass"
    return False


def title(event):
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        f"updated account [{event.get('object', '<object_not_found>')}] "
        "to not require two-factor authentication."
    )


def alert_context(event):
    return duo_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.