Microsoft Sentinel medium experimental kql

GitLab - Brute-force Attempts

'This query relies on GitLab Application Logs to get failed logins to highlight brute-force attempts from different IP addresses in a short space of time.'

View Source

Detection Logic

let LearningPeriod = 7d; 
let EndLearningTime = now();
let BinTime = 1h; 
let RunTime = 1h; 
let MinThreshold = 3.0; 
let GitLabFailedLogins = (GitLabApp
| where FailedLogin == 1
| parse kind=regex Message with "Failed Login: username=" User "ip=" IpAddress
| project TimeGenerated, EventTime, Computer, User, HostName, HostIP, IpAddress);
GitLabFailedLogins
| where EventTime between (ago(LearningPeriod) .. EndLearningTime)
| summarize FailedLoginsCountInBinTime = count() by User, bin(EventTime, BinTime)
| summarize AvgOfFailedLoginsInLearning = avg(FailedLoginsCountInBinTime), StdOfFailedLoginsInLearning = stdev(FailedLoginsCountInBinTime) by User
| extend LearningThreshold = max_of(AvgOfFailedLoginsInLearning, MinThreshold)
| join kind=innerunique ( GitLabFailedLogins
| summarize FailedLoginsCountInRunTime = count() by User, IpAddress, EventTime = bin(EventTime, BinTime) ) on User
| where FailedLoginsCountInRunTime >= LearningThreshold
| project User, IpAddress, EventTime, FailedLoginsCountInRunTime, LearningThreshold

Field Validations

Loading…

Comments (0)

Loading comments...