GitLab - Local Auth - No MFA

Back


Id	e0b45487-5c79-482d-8ac0-695de8c031af
Rulename	GitLab - Local Auth - No MFA
Description	This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on ‘admin’ privileges but the parameter can be adapted to also include all users.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
Version	1.0.1
Arm template	e0b45487-5c79-482d-8ac0-695de8c031af.json

KQL

let isAdmin = true;
GitLabAudit
| where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));

YAML

triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPAddress
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AuthorUserName
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
name: GitLab - Local Auth - No MFA
relevantTechniques:
- T1110
status: Available
version: 1.0.1
queryPeriod: 1d
kind: Scheduled
id: e0b45487-5c79-482d-8ac0-695de8c031af
query: |
  let isAdmin = true;
  GitLabAudit
  | where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));  
description: |
    'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'
queryFrequency: 1h
severity: Medium
triggerOperator: gt
tactics:
- CredentialAccess

ARM