GitLab - SSO - Sign-Ins Burst

Status: available
Severity: medium
Time window: 1d
Group by: User
Source: github.com/Azure/Azure-Sentinel

This query relies on Microsoft Entra ID sign-in activity when Microsoft Entra ID is used for SSO with GitLab to highlights GitLab accounts associated with multiple authentications from different geographical locations in a short space of time.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Telemetry coverage

Platform	Record / event type
Entra ID	`SigninLogs` sign-in event: Successful sign-in
Entra ID	`SigninLogs` sign-in event: Sign-in naming a target application

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: 57b1634b-531d-4eab-a456-8b855887428f
name: GitLab - SSO - Sign-Ins Burst 
description: |
  'This query relies on Microsoft Entra ID sign-in activity when Microsoft Entra ID is used for SSO with GitLab to highlights GitLab accounts associated with multiple authentications from different geographical locations in a short space of time.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let locationCountMin = 1;
  let appRegistrationName = "GitLab";
  SigninLogs
  | where AppDisplayName == appRegistrationName
  | where ResultType == 0
  | where Location != ""
  | summarize CountOfLocations = dcount(Location), Locations = make_set(Location) by User = Identity
  | where CountOfLocations > locationCountMin
entityMappings:
   - entityType: Account
     fieldMappings:
      - identifier: FullName
        columnName: User
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let locationCountMin = 1;
let appRegistrationName = "GitLab";

Stage 1: `source`

SigninLogs

Stage 2: `where`

| where AppDisplayName == appRegistrationName

Stage 3: `where`

| where ResultType == 0

Stage 4: `where`

| where Location != ""

Stage 5: `summarize`

| summarize CountOfLocations = dcount(Location), Locations = make_set(Location) by User = Identity

Stage 6: `where`

| where CountOfLocations > locationCountMin

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AppDisplayName`	eq	`GitLab`	`field:"Application" kind:eq value:"GitLab"`
`CountOfLocations`	gt	`1`	`field:"CountOfLocations" kind:gt value:"1"`
`ResultType`	eq	`0`	`field:"ResultType" kind:eq value:"0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CountOfLocations`	`summarize`
`Locations`	`summarize`
`User`	`summarize`