GitLab - Personal Access Tokens creation over time

Status: available
Severity: medium
Time window: 1d
Group by: AuthorName, Repository, TimeGenerated
Source: github.com/Azure/Azure-Sentinel

'This queries GitLab Audit Logs for access tokens. Attacker can exfiltrate data from you GitLab repository after gaining access to it by generating or hijacking access tokens. This hunting queries allows you to track the personal access tokens creation for each of your repositories. The visualization allow you to quickly identify anomalies/excessive creation, to further investigate repo access & permissions.'

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1213` Data from Information Repositories

Rule body

id: 4d6d8b0e-6d9a-4857-a141-f5d89393cddb
name: GitLab - Personal Access Tokens creation over time
description: |
  'This queries GitLab Audit Logs for access tokens. Attacker can exfiltrate data from you GitLab repository after gaining access to it by generating or hijacking access tokens. 
  This hunting queries allows you to track the personal access tokens creation for each of your repositories. 
  The visualization allow you to quickly identify anomalies/excessive creation, to further investigate repo access & permissions.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    dataTypes: 
      - Syslog
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
relevantTechniques:
  - T1213
query: |
  // l_min_tokens_created - minimum tokens created per repository per user per day to consider
  let l_min_tokens_created = 0;
  let interval = 1d;
  GitLabAudit
  | where TargetType == "PersonalAccessToken"
  | project Severity, TimeGenerated = bin(todatetime(EventTime),1d), AuthorName, IPAddress, Repository = EntityName, Action, TargetType
  | summarize total = count() by Repository, TimeGenerated, AuthorName
  | where total >= l_min_tokens_created
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AuthorName
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let l_min_tokens_created = 0;
let interval = 1d;

Stage 1: `source`

GitLabAudit

Stage 2: `where`

| where TargetType == "PersonalAccessToken"

Stage 3: `project`

| project Severity, TimeGenerated = bin(todatetime(EventTime),1d), AuthorName, IPAddress, Repository = EntityName, Action, TargetType

Stage 4: `summarize`

| summarize total = count() by Repository, TimeGenerated, AuthorName

Stage 5: `where`

| where total >= l_min_tokens_created

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetType`	eq	`PersonalAccessToken`	`field:"TargetType" kind:eq value:"PersonalAccessToken"`
`total`	ge	`0`	`field:"total" kind:ge value:"0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AuthorName`	`summarize`
`Repository`	`summarize`
`TimeGenerated`	`summarize`
`total`	`summarize`