Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository

title: "Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository"
id: 237dbce9-4966-4d69-ab99-a0357f5afbbd
status: test
description: This rule identifies audit events where a Bitbucket project or repository secret scanning rule is deleted. Removing secret scanning controls can reduce an organization’s ability to detect exposed credentials and may be used to impair defenses. It relies on Bitbucket audit telemetry with specific audit type categories and actions for project and repository secret scanning rule deletions.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Basic" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category:
      - Projects
      - Repositories
    auditType.action:
      - Project secret scanning rule deleted
      - Repository secret scanning rule deleted
  condition: selection
falsepositives:
  - Legitimate user activity.
level: low
license: DRL-1.1
related:
  - id: ff91e3f0-ad15-459f-9a85-1556390c138d
    type: derived