identity-mfa-duo-verify
Identity Mfa Duo Verify.
- License 许可
- MIT
- 最近更新
- 2026-09-01
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- identity-mfa-duo-verify
- domain
- cybersecurity
- description
- Identity Mfa Duo Verify.
02 资源文件 1
- 参考文档index.json492 B
03 SKILL.md 正文
-| | MFA | IA-2(1) | Multi-factor authentication for network access | | MFA for Privileged | IA-2(2) | MFA for privileged account access | | Replay Resistance | IA-2(8) | Replay-resistant authentication | | Device Identification | IA-3 | Device identity and trust | | Authenticator Management | IA-5 | MFA enrollment and lifecycle |
Common Pitfalls
- Not deploying phishing-resistant MFA (Verified Push/FIDO2) for privileged accounts
- Setting failmode to "safe" (allow access when Duo is down) in production
- Not disabling SMS/phone call for users with app-capable devices
- Forgetting to configure offline access for laptops
- Not monitoring for MFA fatigue/prompt bombing attacks
Verification
- [ ] VPN login requires Duo MFA
- [ ] RDP to servers requires Duo MFA
- [ ] SSH access requires Duo MFA
- [ ] Verified Push enabled for privileged users
- [ ] Device health policy blocks non-compliant devices
- [ ] Authentication logs forwarded to SIEM
- [ ] Bypass/emergency access procedures tested
- [ ] MFA fatigue detection alerts configured
04 同仓库更多 Skills
services-wmi-persistence-detect
Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.
services-wmi-exec-exploit
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
registry-artifact-extract
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
processes-token-impersonate-detect
Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.
processes-thread-injection-detect
Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.
processes-hollow-technique-detect
Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.