Bitbucket User Login Failure

Status: test
Severity: medium
Log source: product bitbucket, service audit
Author: Muhammad Faisal (@faisalusuf)
Source: github.com/SigmaHQ/sigma

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Known false positives

Legitimate user wrong password attempts.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts
Credential Access	`T1110` Brute Force

Rule body

title: Bitbucket User Login Failure
id: 70ed1d26-0050-4b38-a599-92c53d57d45a
status: test
description: |
    Detects user authentication failure events.
    Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
references:
    - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
author: Muhammad Faisal (@faisalusuf)
date: 2024-02-25
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
logsource:
    product: bitbucket
    service: audit
    definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
    selection:
        auditType.category: 'Authentication'
        auditType.action: 'User login failed'
    condition: selection
falsepositives:
    - Legitimate user wrong password attempts.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    auditType.category: 'Authentication'
    auditType.action: 'User login failed'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`auditType.action`	eq	`User login failed`	`field:"auditType.action" kind:eq value:"User login failed"`
`auditType.category`	eq	`Authentication`	`field:"auditType.category" kind:eq value:"Authentication"`