Bitbucket Audit: Unauthorized Access to a Resource
Flags Bitbucket audit events reporting unauthorized access attempts to a resource.
FreeReviewedSigma · Critical · v5
- Product
- bitbucket
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Bitbucket audit events where an action is recorded as an unauthorized access attempt to a resource. Attackers may probe for restricted content or operations, and these events indicate access attempts that were not permitted. The detection relies on Bitbucket audit log records matching the event category and action for unauthorized access to a resource.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
bitbucket-audit-unauthorized-access-to-a-resource-7215374a
title: "Bitbucket Audit: Unauthorized Access to a Resource"
id: 35e5f099-bb50-4556-8bc4-45ddf0bbbaf2
status: test
description: This rule flags Bitbucket audit events where an action is recorded as an unauthorized access attempt to a resource. Attackers may probe for restricted content or operations, and these events indicate access attempts that were not permitted. The detection relies on Bitbucket audit log records matching the event category and action for unauthorized access to a resource.
references:
- https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
- attack.resource-development
- attack.t1586
logsource:
product: bitbucket
service: audit
definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
selection:
auditType.category: Security
auditType.action: Unauthorized access to a resource
condition: selection
falsepositives:
- Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases.
level: critical
license: DRL-1.1
related:
- id: 7215374a-de4f-4b33-8ba5-70804c9251d3
type: derived