Aruba ClearPass MAC Authentication Bypass on 802.1X Port
Detects authentication succeeding via MAC address where certificate or credential based 802.1X is expected. MAC addresses are trivially spoofed, so a port falling back to MAC authentication is a weak point an attacker can walk through by cloning the address of a permitted device such as a printer or IP phone. Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261). Integration guide: https://bloo.io/docs/integrations/aruba-clearpass BQL (Bloo Query Language): stream=authentication where sourcename='ARUBA-CLEARPASS' and action='LOGIN' | groupby authproto, user, srcip, role
Sigma
