Browse Rules

GitLab - External User Added to GitLab

'This queries GitLab Application logs to list external user accounts (i.e.: account not in allow-listed domains) which have been added to GitLab users.'

EXPL_GitLab_CE_RCE_CVE_2021_22205 [yara]

Detects signs of exploitation of GitLab CE CVE-2021-22205

GitLab - TI - Connection from Malicious IP

'This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs.'

[EXTRAHOP] CVE-2021-22205 GitLab CE and EE Exploit Attempt

[EXTRAHOP] CVE-2021-22205 GitLab CE and EE Exploit Attempt

GitLab - Repository visibility to Public

'This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.'

CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails

Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.

CVE-2023-7028 - GitLab Production Password Reset Multiple Emails

Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.

GitLab - SSO - Sign-Ins Burst

'This query relies on Microsoft Entra ID sign-in activity when Microsoft Entra ID is used for SSO with GitLab to highlights GitLab accounts associated with multiple authentications from different geographical locations in a short space of time.'

GitLab - User Impersonation

'This queries GitLab Audit Logs for user impersonation. A malicious operator or a compromised admin account could leverage the impersonation feature of GitLab to change code or repository settings bypassing usual processes. This hunting queries allows you to track the audit actions done under impersonation.'

GitLab - Brute-force Attempts

'This query relies on GitLab Application Logs to get failed logins to highlight brute-force attempts from different IP addresses in a short space of time.'

EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204 [yara]

Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205

GitLab - Local Auth - No MFA

'This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.'

GitLab - Personal Access Tokens creation over time

'This queries GitLab Audit Logs for access tokens. Attacker can exfiltrate data from you GitLab repository after gaining access to it by generating or hijacking access tokens. This hunting queries allows you to track the personal access tokens creation for each of your repositories. The visualization allow you to quickly identify anomalies/excessive creation, to further investigate repo access & permissions.'

GitLab - Abnormal number of repositories deleted

'This hunting queries identify an unusual increase of repo deletion activities adversaries may want to disrupt availability or compromise integrity by deleting business data.'