User Logged in wihout MFA

AnalysisType: rule
Filename: teleport_local_user_login_without_mfa.py
RuleID: Teleport.LocalUserLoginWithoutMFA
DisplayName: User Logged in wihout MFA
Enabled: true
LogTypes:
  - Gravitational.TeleportAudit
Tags:
  - Teleport
Severity: High
Description: A local User logged in without MFA
DedupPeriodMinutes: 60
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
Reference: https://goteleport.com/docs/management/admin/
Runbook: >
  A local user logged in without Multi-Factor Authentication
SummaryAttributes:
  - event
  - code
  - user
  - success
  - mfa_device
Tests:
  - Name: User logged in with MFA
    ExpectedResult: false
    Log:
      {
        "addr.remote": "[2001:db8:feed:face:c0ff:eeb0:baf00:00d]:65123",
        "cluster_name": "teleport.example.com",
        "code": "T1000I",
        "ei": 0,
        "event": "user.login",
        "method": "local",
        "mfa_device":
          {
            "mfa_device_name": "1Password",
            "mfa_device_type": "WebAuthn",
            "mfa_device_uuid": "88888888-4444-4444-4444-222222222222",
          },
        "success": true,
        "time": "2023-09-20T19:00:00.123456Z",
        "uid": "88888888-4444-4444-4444-222222222222",
        "user": "max.mustermann",
        "user_agent": "Examplecorp Spacedeck-web/99.9 (Hackintosh; ARM Cortex A1000)",
      }
  - Name: User logged in without MFA
    ExpectedResult: false
    Log:
      {
        "addr.remote": "[2001:db8:face:face:face:face:face:face]:65123",
        "cluster_name": "teleport.example.com",
        "code": "T1000I",
        "ei": 0,
        "event": "user.login",
        "method": "local",
        "success": true,
        "time": "2023-09-20T19:00:00.123456Z",
        "uid": "88888888-4444-4444-4444-222222222222",
        "user": "max.mustermann",
        "user_agent": "Examplecorp Spacedeck-web/99.9 (Hackintosh; ARM Cortex A1000)",
      }


# ------ paired body: teleport_local_user_login_without_mfa.py ------

SENSITIVE_LOCAL_USERS = ["breakglass"]


def rule(event):
    return (
        event.get("event") == "user.login"
        and event.get("success") == "true"
        and event.get("method") == "local"
        and not event.get("mfa_device")
    )


def severity(event):
    if event.get("user") in SENSITIVE_LOCAL_USERS:
        return "HIGH"
    return "MEDIUM"


def title(event):
    return (
        f"User [{event.get('user', '<UNKNOWN_USER>')}] logged into "
        f"[{event.get('cluster_name', '<UNNAMED_CLUSTER>')}] locally "
        f"without using MFA"
    )