GitLab - Local Auth - No MFA

Back


Id	e0b45487-5c79-482d-8ac0-695de8c031af
Rulename	GitLab - Local Auth - No MFA
Description	This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on ‘admin’ privileges but the parameter can be adapted to also include all users.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
Version	1.0.1
Arm template	e0b45487-5c79-482d-8ac0-695de8c031af.json

KQL

let isAdmin = true;
GitLabAudit
| where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));

YAML

description: |
    'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'
kind: Scheduled
tactics:
- CredentialAccess
requiredDataConnectors:
- connectorId: SyslogAma
  dataTypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
severity: Medium
name: GitLab - Local Auth - No MFA
triggerThreshold: 0
queryPeriod: 1d
query: |
  let isAdmin = true;
  GitLabAudit
  | where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));  
relevantTechniques:
- T1110
id: e0b45487-5c79-482d-8ac0-695de8c031af
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.1
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: AuthorUserName
    identifier: FullName

ARM