huntrule

Bitbucket Audit Log Configuration Updated

Flags Bitbucket audit log configuration change events that may indicate attempts to impair logging.

FreeUnreviewedSigmamediumv1
title: Bitbucket Audit Log Configuration Updated
id: 985f3e2b-e133-4041-8bd4-1d08a6dea581
status: test
description: This rule identifies events where Bitbucket audit log settings are updated. Attackers may attempt to change audit logging configuration to reduce visibility or tamper with evidence, so configuration change events are high-signal for defense impairment. Detection relies on Bitbucket audit events matching the audit category and the specific action "Audit log configuration updated".
references:
  - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Basic" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Auditing
    auditType.action: Audit log configuration updated
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 6aa12161-235a-4dfb-9c74-fe08df8d8da1
    type: derived

What it detects

This rule identifies events where Bitbucket audit log settings are updated. Attackers may attempt to change audit logging configuration to reduce visibility or tamper with evidence, so configuration change events are high-signal for defense impairment. Detection relies on Bitbucket audit events matching the audit category and the specific action "Audit log configuration updated".

Known false positives

  • Legitimate user activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.