GitLab - Local Auth - No MFA

Back


Id	e0b45487-5c79-482d-8ac0-695de8c031af
Rulename	GitLab - Local Auth - No MFA
Description	This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on ‘admin’ privileges but the parameter can be adapted to also include all users.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
Version	1.0.1
Arm template	e0b45487-5c79-482d-8ac0-695de8c031af.json

KQL

let isAdmin = true;
GitLabAudit
| where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));

YAML

description: |
    'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: SyslogAma
query: |
  let isAdmin = true;
  GitLabAudit
  | where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));  
triggerThreshold: 0
name: GitLab - Local Auth - No MFA
relevantTechniques:
- T1110
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: AuthorUserName
    identifier: FullName
tactics:
- CredentialAccess
queryPeriod: 1d
severity: Medium
status: Available
queryFrequency: 1h
id: e0b45487-5c79-482d-8ac0-695de8c031af
kind: Scheduled
version: 1.0.1
triggerOperator: gt

ARM