Bitbucket Audit: Global SSH Settings Changed

Alerts on Bitbucket global SSH settings changes from audit logs under the Global administration category.

FreeReviewedSigma · Medium · v5

Product: bitbucket
Service: audit
Author: Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
Published: 2024-02-25
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.004SSH
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies changes to Bitbucket global SSH access configuration by matching audit events labeled with category "Global administration" and action "SSH settings changed." Attackers may abuse global SSH settings to enable access paths or weaken authentication boundaries, making unauthorized configuration changes important to review. It relies on Bitbucket audit log telemetry containing the relevant audit category and action fields for these administrative updates.

Reporting behind it

Related detections9 linkedT1021.004 — drag to rearrange

Malicious Bad Apples Remote Apple Events Lateral Movement via osascript

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Suspicious Automated SSH Lateral Movement with Batch Mode (via process_creation)

OpenSSH Native Server Feature Installation (via powershell)

OpenSSH Server Listening on Socket (via openssh)

Suspicious macOS SSH Loopback Connection for TCC Bypass

Suspicious sshpass Noninteractive SSH Password Authentication (via process_creation)

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Bitbucket Audit: Global SSH Settings Changed

Pivot detection · T1021.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

bitbucket-audit-global-ssh-settings-changed-16ab6143

title: "Bitbucket Audit: Global SSH Settings Changed"
id: 91247a0a-25d2-4916-84df-e18e68f0306b
status: test
description: This rule identifies changes to Bitbucket global SSH access configuration by matching audit events labeled with category "Global administration" and action "SSH settings changed." Attackers may abuse global SSH settings to enable access paths or weaken authentication boundaries, making unauthorized configuration changes important to review. It relies on Bitbucket audit log telemetry containing the relevant audit category and action fields for these administrative updates.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.lateral-movement
  - attack.defense-impairment
  - attack.t1685
  - attack.t1021.004
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Global administration
    auditType.action: SSH settings changed
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 16ab6143-510a-44e2-a615-bdb80b8317fc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL