GitLab - Local Auth - No MFA

Back


Id	e0b45487-5c79-482d-8ac0-695de8c031af
Rulename	GitLab - Local Auth - No MFA
Description	This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on ‘admin’ privileges but the parameter can be adapted to also include all users.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
Version	1.0.1
Arm template	e0b45487-5c79-482d-8ac0-695de8c031af.json

KQL

let isAdmin = true;
GitLabAudit
| where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));

YAML

triggerThreshold: 0
relevantTechniques:
- T1110
requiredDataConnectors:
- connectorId: SyslogAma
  dataTypes:
  - Syslog
tactics:
- CredentialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
queryFrequency: 1h
query: |
  let isAdmin = true;
  GitLabAudit
  | where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));  
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: AuthorUserName
    identifier: FullName
kind: Scheduled
description: |
    'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'
severity: Medium
id: e0b45487-5c79-482d-8ac0-695de8c031af
status: Available
name: GitLab - Local Auth - No MFA
version: 1.0.1
queryPeriod: 1d
triggerOperator: gt

ARM