Bitbucket Audit: Global Permission Added or Removed

title: "Bitbucket Audit: Global Permission Added or Removed"
id: d37f7bb5-c926-4785-bfcb-028da10e6684
status: test
description: This rule flags Bitbucket audit events where global permissions are requested, granted, or removed. Changes to global permissions can enable persistent unauthorized access or privilege escalation if an attacker or compromised account modifies high-impact access controls. It relies on Bitbucket audit log telemetry with auditType.category set to Permissions and auditType.action matching global permission add/remove request and outcome events.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/global-permissions-776640369.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Permissions
    auditType.action:
      - Global permission remove request
      - Global permission removed
      - Global permission granted
      - Global permission requested
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: aac6c4f4-87c7-4961-96ac-c3fd3a42c310
    type: derived