Bitbucket User Login Failure Detection
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
Sigma
