Cisco Duo - Failed MFA Login within 5 mins
Cisco Duo Failed MFA Login within 5 minutes highlights repeated authentication failures that may indicate MFA fatigue attacks, credential abuse, or ongoing account takeover attempts.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = cisco
| #event.module = "duo"
| event.action = "authentication"
| Vendor.reason =~ in(values=["no_keys_pressed","invalid_passcode","verification_code_incorrect","user_cancelled","no_response"])
|groupBy([user.name],function=[count(field=Vendor.reason, distinct=true, as=reason),collect(fields=[source.geo.country_name, source.ip,Vendor.reason]),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
|reason >1
| time_diff_min := (end_time - start_time) / 60000
| time_diff_min <= 5
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone=UTC)
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone=UTC)
| drop([start_time, end_time])Cisco Duo Failed MFA Login within 5 minutes highlights repeated authentication failures that may indicate MFA fatigue attacks, credential abuse, or ongoing account takeover attempts.
cisco_duo_failed_mfa_login_within_5_mins.yml
T1621
Kundan Kumar
Detection
Other
2026-06-05
2026-06-05
