Bitbucket Audit: Unauthorized access to a resource

Flags Bitbucket audit events reporting unauthorized access attempts to a resource.

FreeUnreviewedSigmacriticalv1

bitbucket-audit-unauthorized-access-to-a-resource-7215374a

title: "Bitbucket Audit: Unauthorized access to a resource"
id: 35e5f099-bb50-4556-8bc4-45ddf0bbbaf2
status: test
description: This rule identifies Bitbucket audit events where the action indicates an unauthorized access attempt to a resource. Such activity matters because it reflects attempted access beyond permitted scope and may indicate probing or misconfigurations. The detection relies on Bitbucket audit log telemetry with an event category of Security and an action value of unauthorized access to a resource.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.resource-development
  - attack.t1586
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Security
    auditType.action: Unauthorized access to a resource
  condition: selection
falsepositives:
  - Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases.
level: critical
license: DRL-1.1
related:
  - id: 7215374a-de4f-4b33-8ba5-70804c9251d3
    type: derived

What it detects

This rule identifies Bitbucket audit events where the action indicates an unauthorized access attempt to a resource. Such activity matters because it reflects attempted access beyond permitted scope and may indicate probing or misconfigurations. The detection relies on Bitbucket audit log telemetry with an event category of Security and an action value of unauthorized access to a resource.

Known false positives

Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.