Bitbucket Audit: User Permissions Export Attempt Detection

Alerts on Bitbucket audit events indicating user permissions export activity (started, exported, or failed).

FreeReviewedSigma · Medium · v5

Product: bitbucket
Service: audit
Author: Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
Published: 2024-02-25
Updated: 2026-07-31

ATT&CK techniques

Recon → Collection

Recon
- T1591.004Identify Roles
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
- T1213Data from Information Repositories
C2
Exfiltration
Impact

What it detects

This rule identifies Bitbucket audit events related to exporting user permissions, including failed, started, and completed exports. Such activity matters because exporting user details can support reconnaissance and discovery prior to further access attempts. The detection relies on Bitbucket audit telemetry fields for audit type category and the specific export-related audit actions.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Bitbucket Audit: User Permission Details Export Attempts

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Bitbucket Audit: User Permissions Export Attempt Detection

Pivot detection · T1082 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

bitbucket-audit-logs-user-permissions-export-attempt-5259cbf2

title: "Bitbucket Audit: User Permissions Export Attempt Detection"
id: a06c347e-d757-4bf7-952f-7ef0fefabc64
status: test
description: This rule identifies Bitbucket audit events related to exporting user permissions, including failed, started, and completed exports. Such activity matters because exporting user details can support reconnaissance and discovery prior to further access attempts. The detection relies on Bitbucket audit telemetry fields for audit type category and the specific export-related audit actions.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.collection
  - attack.reconnaissance
  - attack.discovery
  - attack.t1213
  - attack.t1082
  - attack.t1591.004
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Users and groups
    auditType.action:
      - User permissions export failed
      - User permissions export started
      - User permissions exported
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL