CISA KEV Alert: Maximum-Severity GitLab Flaw Under Active Exploitation — Detection and Remediation Guide

---
title: GitLab Service Process Spawning Shell or Command Interpreter
id: 3f8a2c91-7d4e-4b1a-9c6f-2e5d8a1b4f09
status: experimental
description: Detects GitLab application components (workhorse, puma, gitaly, sidekiq) spawning shell interpreters or scripting engines, a strong indicator of webshell or post-RCE command execution on a GitLab host.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://about.gitlab.com/security-releases/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/gitlab-workhorse'
      - '/puma'
      - '/gitaly'
      - '/sidekiq'
      - '/gitlab-rails'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/ruby'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - GitLab backup or maintenance scripts invoked through application hooks (rare; baseline per host)
level: high
---
title: Webshell or Script Dropped in GitLab Data and Upload Directories
id: 8c1e5b74-3a2f-4d98-b7e1-6f4c9a2d5e08
status: experimental
description: Detects creation of executable script files in GitLab public upload, artifacts, or tmp directories, consistent with webshell deployment following exploitation of a GitLab web vulnerability.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/opt/gitlab/gitlab-rails/uploads/'
      - '/var/opt/gitlab/gitlab-rails/shared/artifacts/'
      - '/var/opt/gitlab/gitlab-rails/tmp/'
      - '/opt/gitlab/embedded/service/gitlab-rails/public/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.py'
      - '.rb'
      - '.sh'
      - '.pl'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate CI artifacts containing scripts (tune to uploads/ and tmp/ paths if noisy)
level: high
---
title: Outbound Connection from GitLab Host to Rare External Destination
id: 5d2f9a18-4c6b-4e1f-8a3d-9b7c2e4f6a01
status: experimental
description: Detects the git or gitlab service account establishing outbound network connections to non-standard destinations, consistent with C2 or data exfiltration from a compromised GitLab server.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    User:
      - 'git'
      - 'gitlab'
      - 'gitlab-www'
      - 'gitlab-redis'
    Initiated: 'true'
  filter_legit:
    DestinationIp|contains:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_legit
falsepositives:
  - GitLab checking for updates or reaching configured package mirrors (allowlist known-good destinations per environment)
level: medium

// Hunt: GitLab service processes spawning shells, interpreters, or downloaders
// Scope: hosts ingesting Linux syslog/auditd process events into Sentinel
let lookback = 30d;
let gitlab_parents = dynamic(["gitlab-workhorse", "puma", "gitaly", "sidekiq", "gitlab-rails"]);
let suspicious_children = dynamic(["sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat"]);
union isfuzzy=true
  (Syslog
   | where TimeGenerated > ago(lookback)
   | where ProcessName in~ (suspicious_children)
   | where SyslogMessage has_any (gitlab_parents)
   | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP),
  (DeviceProcessEvents
   | where TimeGenerated > ago(lookback)
   | where InitiatingProcessFileName has_any (gitlab_parents)
   | where FileName in~ (suspicious_children)
   | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName)
| order by TimeGenerated desc;

// Hunt: GitLab hosts making outbound connections to rare destinations
// Requires CEF/firewall or Defender network telemetry
let gitlab_hosts = (Syslog
   | where TimeGenerated > ago(7d)
   | where SyslogMessage has "gitlab"
   | summarize by Computer);
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceAction !in ("deny", "drop")
| where SourceHostName in (gitlab_hosts) or SourceIP in (gitlab_hosts)
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
| summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| where ConnectionCount < 50
| order by FirstSeen asc;

-- Hunt GitLab hosts for post-exploitation: suspicious child processes and dropped scripts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)^(sh|bash|dash|python|python3|perl|curl|wget|nc|ncat|socat)$')
  AND (Username =~ '(?i)git|gitlab')

SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/opt/gitlab/gitlab-rails/uploads/**/*.sh',
  '/var/opt/gitlab/gitlab-rails/uploads/**/*.php',
  '/var/opt/gitlab/gitlab-rails/uploads/**/*.py',
  '/var/opt/gitlab/gitlab-rails/tmp/**/*.sh',
  '/var/opt/gitlab/gitlab-rails/tmp/**/*.rb',
  '/opt/gitlab/embedded/service/gitlab-rails/public/**/*.php'
])
WHERE Mtime > now() - 2592000
ORDER BY Mtime DESC

#!/bin/bash
# GitLab security posture check — run as root on each self-hosted GitLab host

echo "=== Installed GitLab version ==="
gitlab-rake gitlab:env:info 2>/dev/null || cat /opt/gitlab/version-manifest.txt | head -5

echo ""
echo "=== Is this host internet-reachable? (listening ports) ==="
ss -tlnp | grep -E ':(80|443|22)\s' 

echo ""
echo "=== Suspicious child processes of GitLab services ==="
ps -eo pid,ppid,user,comm,args --forest | grep -E 'gitlab-workhorse|puma|gitaly|sidekiq' -A1 | grep -E 'bash|sh$|python|perl|curl|wget|nc ' || echo "None found"

echo ""
echo "=== Recently modified files in GitLab data paths (last 14 days) ==="
find /var/opt/gitlab/gitlab-rails/uploads /var/opt/gitlab/gitlab-rails/tmp \
  -type f \( -name '*.sh' -o -name '*.php' -o -name '*.py' -o -name '*.rb' \) \
  -mtime -14 -ls 2>/dev/null || echo "None found"

echo ""
echo "=== Local admin users created in GitLab (review for unknown accounts) ==="
gitlab-rails runner 'User.admins.each { |u| puts "#{u.username} | #{u.email} | created: #{u.created_at} | last_sign_in: #{u.last_sign_in_at}" }' 2>/dev/null

echo ""
echo "=== Active personal access tokens (rotate anything unrecognized) ==="
gitlab-rails runner 'PersonalAccessToken.active.each { |t| puts "#{t.user&.username} | #{t.name} | expires: #{t.expires_at}" }' 2>/dev/null

echo ""
echo "Review complete. Cross-reference findings with your GitLab access logs at /var/log/gitlab/gitlab-rails/"