Detectionmediumtest

Bitbucket Global SSH Settings Changed

Detects Bitbucket global SSH access configuration changes.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Muhammad FaisalCreated Sun Feb 2516ab6143-510a-44e2-a615-bdb80b8317fcapplication

Log Source

bitbucketaudit

Productbitbucket← raw: bitbucket

Serviceaudit← raw: audit

Definition

Requirements: "Advance" log level is required to receive these audit events.

Detection Logic

detection:
    selection:
        auditType.category: 'Global administration'
        auditType.action: 'SSH settings changed'
    condition: selection

False Positives

Legitimate user activity.

References

Resolving title…

confluence.atlassian.com

Resolving title…

confluence.atlassian.com

MITRE ATT&CK

Tactics

TA0008 · Lateral Movement TA0005 · Defense Evasion

Sub-techniques

T1562.001 · Disable or Modify Tools T1021.004 · SSH

Rule Metadata

Rule ID

16ab6143-510a-44e2-a615-bdb80b8317fc

Status

test

Level

medium

Type

Detection

Created

Sun Feb 25

Author

Muhammad Faisal

Path

rules/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml

Raw Tags

attack.lateral-movementattack.defense-evasionattack.t1562.001attack.t1021.004

View on GitHub