Bitbucket Audit: User Permission Details Export Attempts
Flags Bitbucket user details export attempts in audit logs, including start, success, and failure.
- Product
- bitbucket
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Recon → CollectionResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags audit events in Bitbucket where user permission or user details export operations are started, fail, or complete under the “Users and groups” category. Attackers may use exported user data to enumerate identities and assess access relationships during reconnaissance and discovery. Detection relies on Bitbucket audit log telemetry, specifically the audit type category and actions for user details export outcomes.
Reporting behind it
- confluence.atlassian.comhttps://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- confluence.atlassian.comhttps://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Bitbucket Audit: User Permission Details Export Attempts"
id: 7bc77087-0293-4d77-a865-e107bff20057
status: test
description: This rule flags audit events in Bitbucket where user permission or user details export operations are started, fail, or complete under the “Users and groups” category. Attackers may use exported user data to enumerate identities and assess access relationships during reconnaissance and discovery. Detection relies on Bitbucket audit log telemetry, specifically the audit type category and actions for user details export outcomes.
references:
- https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
- attack.reconnaissance
- attack.collection
- attack.discovery
- attack.t1213
- attack.t1082
- attack.t1591.004
logsource:
product: bitbucket
service: audit
definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
selection:
auditType.category: Users and groups
auditType.action:
- User details export failed
- User details export started
- User details exported
condition: selection
falsepositives:
- Legitimate user activity.
level: medium
license: DRL-1.1
related:
- id: 87cc6698-3e07-4ba2-9b43-a85a73e151e2
type: derived