Bitbucket audit: User login failed authentication events
Flags Bitbucket audit events for user login failures in the authentication category.
FreeReviewedSigma · Medium · v5
- Product
- bitbucket
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Bitbucket audit events where authentication fails due to a user login failure. Failed logins can indicate credential guessing, stolen credentials, or attempts to access accounts without authorization. It relies on Bitbucket audit telemetry containing the authentication category and the specific action indicating a failed login attempt.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
bitbucket-audit-user-login-failed-authentication-events-70ed1d26
title: "Bitbucket audit: User login failed authentication events"
id: 87d7a580-c313-4488-be9c-e6c5fdb13fea
status: test
description: This rule flags Bitbucket audit events where authentication fails due to a user login failure. Failed logins can indicate credential guessing, stolen credentials, or attempts to access accounts without authorization. It relies on Bitbucket audit telemetry containing the authentication category and the specific action indicating a failed login attempt.
references:
- https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1078.004
- attack.t1110
logsource:
product: bitbucket
service: audit
definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
selection:
auditType.category: Authentication
auditType.action: User login failed
condition: selection
falsepositives:
- Legitimate user wrong password attempts.
level: medium
license: DRL-1.1
related:
- id: 70ed1d26-0050-4b38-a599-92c53d57d45a
type: derived