Bitbucket Audit: Global SSH Settings Changed

Alerts on Bitbucket global SSH settings changes from audit logs under the Global administration category.

FreeUnreviewedSigmamediumv1

bitbucket-audit-global-ssh-settings-changed-16ab6143

title: "Bitbucket Audit: Global SSH Settings Changed"
id: 91247a0a-25d2-4916-84df-e18e68f0306b
status: test
description: This rule flags Bitbucket audit events where the global SSH access configuration is changed. Attackers may use SSH configuration changes to enable new access paths or weaken controls across repositories, making this a defense-impairment relevant activity. Detection relies on Bitbucket audit log entries matching the specific global administration category and the 'SSH settings changed' action.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.lateral-movement
  - attack.defense-impairment
  - attack.t1685
  - attack.t1021.004
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Global administration
    auditType.action: SSH settings changed
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 16ab6143-510a-44e2-a615-bdb80b8317fc
    type: derived

What it detects

This rule flags Bitbucket audit events where the global SSH access configuration is changed. Attackers may use SSH configuration changes to enable new access paths or weaken controls across repositories, making this a defense-impairment relevant activity. Detection relies on Bitbucket audit log entries matching the specific global administration category and the 'SSH settings changed' action.

Known false positives

Legitimate user activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.