GitLab - TI - Connection from Malicious IP

Status: available
Severity: medium
Time window: 1d
Group by: IPAddress, IndicatorId, TI_ipEntity
Source: github.com/Azure/Azure-Sentinel

'This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Rule body

id: 7241740a-5280-4b74-820a-862312d721a8
name: GitLab - TI - Connection from Malicious IP 
description: |
  'This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: ThreatIntelligence
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: ThreatIntelligenceTaxii
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: SyslogAma
    dataTypes: 
      - Syslog
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  ThreatIntelligenceIndicator
  | where Action == true
  // Picking up only IOCs that contain the entities we want
  | where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)
  // Taking the first non-empty value based on potential IOC match availability
  | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)
  //Exclude local addresses using ipv4_is_private operator
  |where ipv4_is_private(TI_ipEntity) == false and  TI_ipEntity !startswith "fe80" and TI_ipEntity !startswith "::" and TI_ipEntity !startswith "127."
  | join (GitLabAccess) on $left.TI_ipEntity == $right.IPAddress
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, TimeGenerated = EventTime, TI_ipEntity, IPAddress, URI
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPaddr
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ThreatIntelligenceIndicator

Stage 2: `where`

| where Action == true

Stage 3: `where`

| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)

Stage 4: `extend` (3 consecutive steps)

| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)

TI_ipEntity =

ifisnotempty(NetworkIP)NetworkIP

elseNetworkDestinationIP

Stage 5: `where`

| where ipv4_is_private(TI_ipEntity) == false and  TI_ipEntity !startswith "fe80" and TI_ipEntity !startswith "::" and TI_ipEntity !startswith "127."

Stage 6: `join`

| join (GitLabAccess) on $left.TI_ipEntity == $right.IPAddress

Stage 7: `summarize`

| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId

Stage 8: `project`

| project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, TimeGenerated = EventTime, TI_ipEntity, IPAddress, URI

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TI_ipEntity`	cidr_match	`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `127.0.0.0/8`	`excludes:TI_ipEntity`
`TI_ipEntity`	starts_with	`127.`	`excludes:TI_ipEntity` `field:"TI_ipEntity" value:"127."`
`TI_ipEntity`	starts_with	`::`	`excludes:TI_ipEntity` `field:"TI_ipEntity" value:"::"`
`TI_ipEntity`	starts_with	`fe80`	`excludes:TI_ipEntity` `field:"TI_ipEntity" value:"fe80"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`true`	`field:"Action" kind:eq value:"true"`
`EmailSourceIpAddress`	is_not_null	(no value, null check)	`field:"EmailSourceIpAddress" kind:is_not_null`
`NetworkDestinationIP`	is_not_null	(no value, null check)	`field:"NetworkDestinationIP" kind:is_not_null`
`NetworkIP`	is_not_null	(no value, null check)	`field:"NetworkIP" kind:is_not_null`
`NetworkSourceIP`	is_not_null	(no value, null check)	`field:"NetworkSourceIP" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActivityGroupNames`	`project`
`ConfidenceScore`	`project`
`Description`	`project`
`ExpirationDateTime`	`project`
`IPAddress`	`project`
`IndicatorId`	`project`
`LatestIndicatorTime`	`project`
`TI_ipEntity`	`project`
`ThreatType`	`project`
`TimeGenerated`	`project`
`URI`	`project`
`Url`	`project`

GitLab - TI - Connection from Malicious IP

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend (3 consecutive steps)

Stage 5: where

Stage 6: join

Stage 7: summarize

Stage 8: project