{"id":"T1591.004","name":"Identify Roles","url":"https://attack.mitre.org/techniques/T1591/004","tactics":["reconnaissance"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0807","stix_id":"x-mitre-detection-strategy--5b64c4fd-981e-4f34-97a4-9cd22d6f40e4","name":"Detection of Identify Roles","url":"https://attack.mitre.org/detectionstrategies/DET0807","analytics":[{"id":"AN1939","stix_id":"x-mitre-analytic--a9a66c41-1b05-41fc-a866-272848b051ff","name":"Analytic 1939","description":"Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0807#AN1939","platforms":["PRE"],"log_source_references":[],"mutable_elements":[],"live":true,"detection_strategies":["DET0807"],"techniques":["T1591.004"]}],"live":true,"version":"1.0","techniques":["T1591.004"]}],"sigma_rules":[{"id":"5259cbf2-0a75-48bf-b57a-c54d6fabaef3","title":"Bitbucket User Details Export Attempt Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2024-02-25","modified":null,"description":"Detects user data export activity.","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html","https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.collection","attack.reconnaissance","attack.discovery","attack.t1213","attack.t1082","attack.t1591.004"],"path":"rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml","techniques":["T1213","T1082","T1591.004"],"cves":[]},{"id":"87cc6698-3e07-4ba2-9b43-a85a73e151e2","title":"Bitbucket User Permissions Export Attempt","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2024-02-25","modified":null,"description":"Detects user permission data export attempt.","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html","https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.reconnaissance","attack.collection","attack.discovery","attack.t1213","attack.t1082","attack.t1591.004"],"path":"rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml","techniques":["T1213","T1082","T1591.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}