Bitbucket Secret Scanning Rule Deleted

Title: Bitbucket Secret Scanning Rule Deleted
Status: test
Description:Detects when secret scanning rule is deleted for the project or repository.
References:
  -https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  -https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: bitbucket
• service: audit
• definition: Requirements: "Basic" log level is required to receive these audit events.

Detection:
  selection:
    auditType.category:
      -'Projects'
      -'Repositories'

    auditType.action:
      -'Project secret scanning rule deleted'
      -'Repository secret scanning rule deleted'

  condition:selection
Falsepositives:
  -Legitimate user activity.
Level: low