GitLab - Local Auth - No MFA

Status: available
Severity: medium
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: e0b45487-5c79-482d-8ac0-695de8c031af
name: GitLab - Local Auth - No MFA 
description: |
  'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    dataTypes: 
      - Syslog
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let isAdmin = true;
  GitLabAudit
  | where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AuthorUserName
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let isAdmin = true;

Stage 1: `source`

GitLabAudit

Stage 2: `where`

| where AuthenticationType == "standard" and ((isAdmin and TargetDetails contains "Administrator") or (isAdmin==false));

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationType`	eq	`standard`	`field:"AuthenticationType" kind:eq value:"standard"`
`TargetDetails`	contains	`Administrator`	`field:"TargetDetails" kind:contains value:"Administrator"`