The Bishop
@bishop0 followers4 downloads4 copies0 likes102 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
Duo User Marked Fraud
YARA-L
This rule detects when a user marks an authentication request as fraudulent within Duo Security. This indicates a potential attempt to gain unauthorized access to a user's account, possibly through MFA fatigue or other social engineering tactics. The rule specifically looks for 'user_marked_fraud' in the security result summary of Duo authentication events.
