Duo User Marked Fraud
This rule detects when a user marks an authentication request as fraudulent within Duo Security. This indicates a potential attempt to gain unauthorized access to a user's account, possibly through MFA fatigue or other social engineering tactics. The rule specifically looks for 'user_marked_fraud' in the security result summary of Duo authentication events.
YARA-L
