Bitbucket SSH User Login Failures (Audit Authentication Events)

Alerts on Bitbucket audit records showing SSH-based user login failures in authentication events.

FreeUnreviewedSigmamediumv1

bitbucket-ssh-user-login-failures-audit-authentication-events-d3f90469

title: Bitbucket SSH User Login Failures (Audit Authentication Events)
id: b05497a7-8696-4f38-8b61-0ccb867bffd4
status: test
description: This rule flags Bitbucket audit events where an SSH user login fails, specifically matching authentication events labeled as "User login failed(SSH)". Repeated failures can indicate credential guessing or incorrect access attempts preceding successful login. It relies on Bitbucket audit telemetry fields for auditType.category and auditType.action within authentication audit records.
references:
  - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html
  - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.lateral-movement
  - attack.credential-access
  - attack.t1021.004
  - attack.t1110
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Authentication
    auditType.action: User login failed(SSH)
  condition: selection
falsepositives:
  - Legitimate user wrong password attempts.
level: medium
license: DRL-1.1
related:
  - id: d3f90469-fb05-42ce-b67d-0fded91bbef3
    type: derived

What it detects

This rule flags Bitbucket audit events where an SSH user login fails, specifically matching authentication events labeled as "User login failed(SSH)". Repeated failures can indicate credential guessing or incorrect access attempts preceding successful login. It relies on Bitbucket audit telemetry fields for auditType.category and auditType.action within authentication audit records.

Known false positives

Legitimate user wrong password attempts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.