Sagan high stable other

[DUO] MFA Authentication Attempt from Outside HOME_COUNTRY

[DUO] MFA Authentication Attempt from Outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[DUO] MFA Authentication Attempt from Outside HOME_COUNTRY"; program:duo; json_content:".eventtype","authentication"; json_content:".result","denied"; country_code:track by_src,isnot $HOME_COUNTRY; json_map: "src_ip", ".access_device.ip"; reference:url,https://help.duo.com/s/article/1023?language=en_US; classtype:attempted-user; sid:5014653; rev:3; metadata:created_at 2024_05_07, updated_at 2024_05_30;)

Field Validations

Loading…

Comments (0)

Loading comments...