GitLab - Personal Access Tokens creation over time

Back


Id	4d6d8b0e-6d9a-4857-a141-f5d89393cddb
Rulename	GitLab - Personal Access Tokens creation over time
Description	This queries GitLab Audit Logs for access tokens. Attacker can exfiltrate data from you GitLab repository after gaining access to it by generating or hijacking access tokens. This hunting queries allows you to track the personal access tokens creation for each of your repositories. The visualization allow you to quickly identify anomalies/excessive creation, to further investigate repo access & permissions.
Severity	Medium
Tactics	Collection
Techniques	T1213
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_PAT_Repo.yaml
Version	1.0.1
Arm template	4d6d8b0e-6d9a-4857-a141-f5d89393cddb.json

KQL

// l_min_tokens_created - minimum tokens created per repository per user per day to consider
let l_min_tokens_created = 0;
let interval = 1d;
GitLabAudit
| where TargetType == "PersonalAccessToken"
| project Severity, TimeGenerated = bin(todatetime(EventTime),1d), AuthorName, IPAddress, Repository = EntityName, Action, TargetType
| summarize total = count() by Repository, TimeGenerated, AuthorName
| where total >= l_min_tokens_created

YAML

entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AuthorName
  entityType: Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_PAT_Repo.yaml
queryFrequency: 1h
triggerOperator: gt
queryPeriod: 1d
query: |
  // l_min_tokens_created - minimum tokens created per repository per user per day to consider
  let l_min_tokens_created = 0;
  let interval = 1d;
  GitLabAudit
  | where TargetType == "PersonalAccessToken"
  | project Severity, TimeGenerated = bin(todatetime(EventTime),1d), AuthorName, IPAddress, Repository = EntityName, Action, TargetType
  | summarize total = count() by Repository, TimeGenerated, AuthorName
  | where total >= l_min_tokens_created  
relevantTechniques:
- T1213
version: 1.0.1
tactics:
- Collection
severity: Medium
name: GitLab - Personal Access Tokens creation over time
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: SyslogAma
triggerThreshold: 0
kind: Scheduled
status: Available
description: |
  'This queries GitLab Audit Logs for access tokens. Attacker can exfiltrate data from you GitLab repository after gaining access to it by generating or hijacking access tokens. 
  This hunting queries allows you to track the personal access tokens creation for each of your repositories. 
  The visualization allow you to quickly identify anomalies/excessive creation, to further investigate repo access & permissions.'  
id: 4d6d8b0e-6d9a-4857-a141-f5d89393cddb

ARM