Duo Authentication via Anonymous IP or Proxy
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
Cortex XDR
