MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: f05271b6-26a5-49cf-ad73-4a202fba6eb6
name: Cisco Duo - New access device
description: |
'Detects new access device.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CiscoDuoAuthConnectorDefinition
dataTypes:
- DuoAuthentication_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1078
query: |
DuoAuthentication_CL
| where Result =~ 'success'
| where isnotempty(AccessDeviceIp)
| summarize dvc_ip = make_set(AccessDeviceIp) by UserName
| join (DuoAuthentication_CL
| where Result =~ 'success') on UserName
| where dvc_ip !has AccessDeviceIp
| extend IPCustomEntity = AccessDeviceIp, AccountCustomEntity = UserName
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
DuoAuthentication_CL
Stage 2: where
| where Result =~ 'success'
Stage 3: where
| where isnotempty(AccessDeviceIp)
Stage 4: summarize
| summarize dvc_ip = make_set(AccessDeviceIp) by UserName
Stage 5: join
| join (DuoAuthentication_CL
| where Result =~ 'success') on UserName
Stage 6: where
| where dvc_ip !has AccessDeviceIp
Stage 7: extend
| extend IPCustomEntity = AccessDeviceIp, AccountCustomEntity = UserName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AccessDeviceIp | is_not_null | field:"AccessDeviceIp" kind:is_not_null | |
Result | eq |
| field:"Result" kind:eq value:"success" |
dvc_ip | cross_field_compare |
| field:"dvc_ip" kind:cross_field_compare value:"AccessDeviceIp" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
UserName | summarize |
dvc_ip | summarize |
AccountCustomEntity | extend |
IPCustomEntity | extend |