Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1110-brute-force

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when Cisco Duo’s Risk-Based Authentication (RBA) engine flags attack patterns for a user and that user subsequently completes a successful authentication, indicating a potential account takeover.

Strategy

This rule monitors Cisco Duo authentication logs for events where Duo’s built-in RBA engine has detected one or more of the following attack indicators: CREDENTIAL_STUFFING, UNREALISTIC_TRAVEL, DEVICE_DISTANCE, NOVEL_ASN, or PREVIOUSLY_MARKED_FRAUD. The rule detects any authentication event where one of these detectors fired, followed by a successful authentication from the same user within a one-hour window. A success event following any RBA-flagged authentication is a strong indicator that an attacker is using or probing credentials against an account that Duo’s risk engine has already identified as under attack.

Triage and Response

• Verify whether {{@usr.name}} had a legitimate reason to authenticate at the time of the event, particularly from the devices and locations recorded in the authentication log.
• Review the specific RBA detector that triggered to understand the nature of the detected attack (for example, UNREALISTIC_TRAVEL suggests geographically impossible access, CREDENTIAL_STUFFING suggests bulk credential replay).
• Examine all denied authentication attempts preceding the successful login to identify the source IPs, ASNs, and device fingerprints associated with the attack.
• Determine if the successful authentication used a weaker factor (for example, sms_passcode or phone_call) compared to the user’s typical factor, which could indicate an MFA downgrade.
• Check for any downstream activity following the successful authentication in applications protected by Duo to assess what resources the attacker may have accessed.
• Review the trusted endpoint status of the device used for the successful login to determine if it is a known-good device or a new, unrecognized endpoint.