Bitbucket audit: User login failed authentication events

title: "Bitbucket audit: User login failed authentication events"
id: 87d7a580-c313-4488-be9c-e6c5fdb13fea
status: test
description: This rule flags Bitbucket audit events where authentication fails due to a user login failure. Failed logins can indicate credential guessing, stolen credentials, or attempts to access accounts without authorization. It relies on Bitbucket audit telemetry containing the authentication category and the specific action indicating a failed login attempt.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Authentication
    auditType.action: User login failed
  condition: selection
falsepositives:
  - Legitimate user wrong password attempts.
level: medium
license: DRL-1.1
related:
  - id: 70ed1d26-0050-4b38-a599-92c53d57d45a
    type: derived