Detectionhightest

Bitbucket Full Data Export Triggered

Detects when full data export is attempted.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Muhammad FaisalCreated Sun Feb 25195e1b9d-bfc2-4ffa-ab4e-35aef69815f8application

Log Source

bitbucketaudit

Productbitbucket← raw: bitbucket

Serviceaudit← raw: audit

Definition

Requirements: "Advance" log level is required to receive these audit events.

Detection Logic

detection:
    selection:
        auditType.category: 'Data pipeline'
        auditType.action: 'Full data export triggered'
    condition: selection

False Positives

Legitimate user activity.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

195e1b9d-bfc2-4ffa-ab4e-35aef69815f8

Status

test

Level

high

Type

Detection

Created

Sun Feb 25

Author

Path

rules/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml

Raw Tags

attack.collectionattack.t1213.003