Bitbucket Audit: SSH User Login Failures

Alerts on Bitbucket audit records showing SSH-based user login failures in authentication events.

FreeReviewedSigma · Medium · v5

Product: bitbucket
Service: audit
Author: Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
Published: 2024-02-25
Updated: 2026-07-31

ATT&CK techniques

Cred Access → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
Discovery
Lateral Movement
- T1021.004SSH
Collection
C2
Exfiltration
Impact

What it detects

Identifies Bitbucket audit events where an SSH user login attempt fails. Failed authentication is a common precursor to credential guessing or unauthorized access attempts against SSH-enabled Git repositories. The rule relies on Bitbucket audit telemetry that records authentication failures with the SSH-specific action values.

Reporting behind it

Related detections9 linkedT1021.004 — drag to rearrange

Malicious Bad Apples Remote Apple Events Lateral Movement via osascript

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Suspicious Automated SSH Lateral Movement with Batch Mode (via process_creation)

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

OpenSSH Native Server Feature Installation (via powershell)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

OpenSSH Server Listening on Socket (via openssh)

Suspicious macOS SSH Loopback Connection for TCC Bypass

Bitbucket Audit: SSH User Login Failures

Pivot detection · T1021.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

bitbucket-ssh-user-login-failures-audit-authentication-events-d3f90469

title: "Bitbucket Audit: SSH User Login Failures"
id: b05497a7-8696-4f38-8b61-0ccb867bffd4
status: test
description: Identifies Bitbucket audit events where an SSH user login attempt fails. Failed authentication is a common precursor to credential guessing or unauthorized access attempts against SSH-enabled Git repositories. The rule relies on Bitbucket audit telemetry that records authentication failures with the SSH-specific action values.
references:
  - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html
  - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.lateral-movement
  - attack.credential-access
  - attack.t1021.004
  - attack.t1110
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Authentication
    auditType.action: User login failed(SSH)
  condition: selection
falsepositives:
  - Legitimate user wrong password attempts.
level: medium
license: DRL-1.1
related:
  - id: d3f90469-fb05-42ce-b67d-0fded91bbef3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL