Bitbucket Audit Logs: User Permissions Export Attempt

title: "Bitbucket Audit Logs: User Permissions Export Attempt"
id: a06c347e-d757-4bf7-952f-7ef0fefabc64
status: test
description: This rule flags Bitbucket audit events where user permissions export is started, successfully exported, or fails. Exporting user details can support attacker reconnaissance and collection by enumerating account information and access-related data. It relies on Bitbucket audit log telemetry with auditType.category set to "Users and groups" and matching specific export-related actions.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.collection
  - attack.reconnaissance
  - attack.discovery
  - attack.t1213
  - attack.t1082
  - attack.t1591.004
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Users and groups
    auditType.action:
      - User permissions export failed
      - User permissions export started
      - User permissions exported
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3
    type: derived