Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Cisco Duo Policy Allow Old Java

The following analytic detects when a Duo policy is created or updated to allow the use of outdated Java versions, which can introduce significant security risks. It works by searching Duo administrator activity logs for policy creation or update actions where the policy explicitly sets 'java_remediation' to 'no remediation', indicating that no restrictions are enforced against old Java. The analytic aggregates relevant details such as the user, admin email, and action context for further investigation. Identifying this behavior is critical for a Security Operations Center (SOC) because allowing outdated Java can expose an organization to known vulnerabilities, malware, and exploitation techniques. Attackers or malicious insiders may attempt to weaken security controls by modifying policies to permit insecure software, increasing the risk of compromise. Prompt detection enables SOC analysts to respond quickly, revert risky changes, and mitigate potential threats before they are exploited.

ATT&CK coverage

Outside the enterprise matrix

T1556

Detection requirements

Log source category: cisco_duo_administrator

What the source says

What fires this without an attack behind it

No false positives have been identified at this time.

References

https://splunkbase.splunk.com/app/7404

Tagged by the source as

Cisco Duo Suspicious ActivityIdentityapplicationSplunk CloudSplunk EnterpriseSplunk Enterprise Securityidentity

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.