Bitbucket Audit: Project Secret Scanning Allowlist Rule Added

title: "Bitbucket Audit: Project Secret Scanning Allowlist Rule Added"
id: 365be920-8c7f-49fc-9266-d67d49e41db8
status: test
description: This rule flags Bitbucket audit events where a secret scanning allowlist rule is added at the project level. Allowlisting can reduce or bypass secret detection, which attackers may abuse to avoid being alerted to exposed credentials. The detection relies on Bitbucket audit log fields for the project category and the specific action indicating the allowlist rule was added.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Basic" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Projects
    auditType.action: Project secret scanning allowlist rule added
  condition: selection
falsepositives:
  - Legitimate user activity.
level: low
license: DRL-1.1
related:
  - id: 42ccce6d-7bd3-4930-95cd-e4d83fa94a30
    type: derived