Bitbucket Audit: User Permission Details Export Attempts

Flags Bitbucket user details export attempts in audit logs, including start, success, and failure.

FreeReviewedSigma · Medium · v5

Product: bitbucket
Service: audit
Author: Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
Published: 2024-02-25
Updated: 2026-07-31

ATT&CK techniques

Recon → Collection

Recon
- T1591.004Identify Roles
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
- T1213Data from Information Repositories
C2
Exfiltration
Impact

What it detects

This rule flags audit events in Bitbucket where user permission or user details export operations are started, fail, or complete under the “Users and groups” category. Attackers may use exported user data to enumerate identities and assess access relationships during reconnaissance and discovery. Detection relies on Bitbucket audit log telemetry, specifically the audit type category and actions for user details export outcomes.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Bitbucket Audit: User Permissions Export Attempt Detection

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Bitbucket Audit: User Permission Details Export Attempts

Pivot detection · T1082 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

bitbucket-audit-logs-user-permissions-export-attempt-87cc6698

title: "Bitbucket Audit: User Permission Details Export Attempts"
id: 7bc77087-0293-4d77-a865-e107bff20057
status: test
description: This rule flags audit events in Bitbucket where user permission or user details export operations are started, fail, or complete under the “Users and groups” category. Attackers may use exported user data to enumerate identities and assess access relationships during reconnaissance and discovery. Detection relies on Bitbucket audit log telemetry, specifically the audit type category and actions for user details export outcomes.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.reconnaissance
  - attack.collection
  - attack.discovery
  - attack.t1213
  - attack.t1082
  - attack.t1591.004
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Users and groups
    auditType.action:
      - User details export failed
      - User details export started
      - User details exported
  condition: selection
falsepositives:
  - Legitimate user activity.
level: medium
license: DRL-1.1
related:
  - id: 87cc6698-3e07-4ba2-9b43-a85a73e151e2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL