Bitbucket Audit Logs: User Permissions Export Attempt

title: "Bitbucket Audit Logs: User Permissions Export Attempt"
id: 7bc77087-0293-4d77-a865-e107bff20057
status: test
description: This rule identifies Bitbucket audit events where user details and permission-related information export is started, successfully exported, or fails. Attackers may use these exports to enumerate users and access-related data to plan further discovery or collection. The detection relies on Bitbucket audit log events with category "Users and groups" and actions indicating export start, completion, or failure.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.reconnaissance
  - attack.collection
  - attack.discovery
  - attack.t1213
  - attack.t1082
  - attack.t1591.004
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Users and groups
    auditType.action:
      - User details export failed
      - User details export started
      - User details exported
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 87cc6698-3e07-4ba2-9b43-a85a73e151e2
    type: derived