GitLab - Local Auth - No MFA

Back


Id	e0b45487-5c79-482d-8ac0-695de8c031af
Rulename	GitLab - Local Auth - No MFA
Description	This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on ‘admin’ privileges but the parameter can be adapted to also include all users.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
Version	1.0.1
Arm template	e0b45487-5c79-482d-8ac0-695de8c031af.json

KQL

let isAdmin = true;
GitLabAudit
| where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));

YAML

status: Available
queryFrequency: 1h
id: e0b45487-5c79-482d-8ac0-695de8c031af
tactics:
- CredentialAccess
entityMappings:
- fieldMappings:
  - columnName: IPAddress
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: AuthorUserName
    identifier: FullName
  entityType: Account
requiredDataConnectors:
- connectorId: SyslogAma
  dataTypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_LocalAuthNoMFA.yaml
version: 1.0.1
query: |
  let isAdmin = true;
  GitLabAudit
  | where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));  
description: |
    'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'
relevantTechniques:
- T1110
triggerThreshold: 0
queryPeriod: 1d
triggerOperator: gt
name: GitLab - Local Auth - No MFA
severity: Medium
kind: Scheduled

ARM