Bitbucket Secret Scanning Exempt Repository Added

calendar Feb 26, 2024 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects when a repository is exempted from secret scanning feature.

Sigma rule (View on GitHub)

 1title: Bitbucket Secret Scanning Exempt Repository Added
 2id: b91e8d5e-0033-44fe-973f-b730316f23a1
 3status: experimental
 4description: Detects when a repository is exempted from secret scanning feature.
 5references:
 6    - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
 7    - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
 8author: Muhammad Faisal (@faisalusuf)
 9date: 2024/02/25
10tags:
11    - attack.defense_evasion
12    - attack.t1562.001
13logsource:
14    product: bitbucket
15    service: audit
16    definition: 'Requirements: "Basic" log level is required to receive these audit events.'
17detection:
18    selection:
19        auditType.category: 'Repositories'
20        auditType.action: 'Secret scanning exempt repository added'
21    condition: selection
22falsepositives:
23    - Legitimate user activity.
24level: high

References

Related rules

to-top