Bitbucket Audit: User login failed authentication events

title: "Bitbucket Audit: User login failed authentication events"
id: 87d7a580-c313-4488-be9c-e6c5fdb13fea
status: test
description: This rule identifies Bitbucket audit events where authentication fails for a user login attempt. Failed logins are a common signal of credential guessing or password-based access attempts and can precede successful compromise. It relies on Bitbucket audit log telemetry capturing authentication category and the specific action indicating a failed user login.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Authentication
    auditType.action: User login failed
  condition: selection
falsepositives:
  - Legitimate user wrong password attempts.
level: medium
license: DRL-1.1
related:
  - id: 70ed1d26-0050-4b38-a599-92c53d57d45a
    type: derived