Bitbucket Global Secret Scanning Rule Deleted

calendar Feb 26, 2024 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects Bitbucket global secret scanning rule deletion activity.

Sigma rule (View on GitHub)

 1title: Bitbucket Global Secret Scanning Rule Deleted
 2id: e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
 3status: experimental
 4description: Detects Bitbucket global secret scanning rule deletion activity.
 5references:
 6    - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
 7    - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
 8author: Muhammad Faisal (@faisalusuf)
 9date: 2024/02/25
10tags:
11    - attack.defense_evasion
12    - attack.t1562.001
13logsource:
14    product: bitbucket
15    service: audit
16    definition: 'Requirements: "Basic" log level is required to receive these audit events.'
17detection:
18    selection:
19        auditType.category: 'Global administration'
20        auditType.action: 'Global secret scanning rule deleted'
21    condition: selection
22falsepositives:
23    - Legitimate user activity.
24level: medium

References

Related rules

to-top