Bitbucket User Login Failure Via SSH

Title: Bitbucket User Login Failure Via SSH
Status: test
Description:Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.
References:
  -https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html
  -https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-02-25
modified:None
Tags:

• -'attack.lateral-movement'
• -'attack.credential-access'
• -'attack.t1021.004'
• -'attack.t1110'

Logsource:

• product: bitbucket
• service: audit
• definition: Requirements: "Advance" log level is required to receive these audit events.

Detection:
  selection:
    auditType.category: 'Authentication'
    auditType.action: 'User login failed(SSH)'
  condition:selection
Falsepositives:
  -Legitimate user wrong password attempts.
Level: medium