Detection rules › Kusto
Cisco Duo - Authentication device new location
'Detects new location of authentication device.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 01df3abe-3dc7-40e2-8aa7-f00b402df6f0
name: Cisco Duo - Authentication device new location
description: |
'Detects new location of authentication device.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CiscoDuoAuthConnectorDefinition
dataTypes:
- DuoAuthentication_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1078
query: |
DuoAuthentication_CL
| where Result =~ 'success'
| where isnotempty(AuthDeviceCountry)
| summarize src_c = make_set(AuthDeviceCountry) by AccessDeviceIp
| join (DuoAuthentication_CL
| where Result =~ 'success') on AccessDeviceIp
| where src_c !has AuthDeviceCountry
| extend IPCustomEntity = AccessDeviceIp, AccountCustomEntity = UserName
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
DuoAuthentication_CL
Stage 2: where
| where Result =~ 'success'
Stage 3: where
| where isnotempty(AuthDeviceCountry)
Stage 4: summarize
| summarize src_c = make_set(AuthDeviceCountry) by AccessDeviceIp
Stage 5: join
| join (DuoAuthentication_CL
| where Result =~ 'success') on AccessDeviceIp
Stage 6: where
| where src_c !has AuthDeviceCountry
Stage 7: extend
| extend IPCustomEntity = AccessDeviceIp, AccountCustomEntity = UserName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AuthDeviceCountry | is_not_null | field:"AuthDeviceCountry" kind:is_not_null | |
Result | eq |
| field:"Result" kind:eq value:"success" |
src_c | cross_field_compare |
| field:"src_c" kind:cross_field_compare value:"AuthDeviceCountry" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccessDeviceIp | summarize |
src_c | summarize |
AccountCustomEntity | extend |
IPCustomEntity | extend |