Bitbucket User Details Export Attempt Detected

Title: Bitbucket User Details Export Attempt Detected
Status: test
Description:Detects user data export activity.
References:
  -https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  -https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
modified:None
Tags:

• -'attack.collection'
• -'attack.reconnaissance'
• -'attack.discovery'
• -'attack.t1213'
• -'attack.t1082'
• -'attack.t1591.004'

Logsource:

• product: bitbucket
• service: audit
• definition: Requirements: "Advance" log level is required to receive these audit events.

Detection:
  selection:
    auditType.category: 'Users and groups'
    auditType.action:
      -'User permissions export failed'
      -'User permissions export started'
      -'User permissions exported'

  condition:selection
Falsepositives:
  -Legitimate user activity.
Level: medium