Bitbucket Audit: Full Data Export Triggered
Alerts when Bitbucket audit logging records a full data export being triggered.
FreeReviewedSigma · High · v5
- Product
- bitbucket
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-02-25
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Bitbucket audit events where a full data export is triggered. Full exports can be used by attackers to rapidly exfiltrate large volumes of repository and pipeline data, so distinguishing export activity from normal operations is important. It relies on Bitbucket audit log fields that record the export action under the data pipeline category.
Reporting behind it
- confluence.atlassian.comhttps://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- confluence.atlassian.comhttps://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
bitbucket-audit-logs-full-data-export-triggered-195e1b9d
title: "Bitbucket Audit: Full Data Export Triggered"
id: 9eea3631-956d-497f-8cfe-96393bc0e934
status: test
description: This rule flags Bitbucket audit events where a full data export is triggered. Full exports can be used by attackers to rapidly exfiltrate large volumes of repository and pipeline data, so distinguishing export activity from normal operations is important. It relies on Bitbucket audit log fields that record the export action under the data pipeline category.
references:
- https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
- attack.collection
- attack.t1213.003
logsource:
product: bitbucket
service: audit
definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
selection:
auditType.category: Data pipeline
auditType.action: Full data export triggered
condition: selection
falsepositives:
- Legitimate user activity.
level: high
license: DRL-1.1
related:
- id: 195e1b9d-bfc2-4ffa-ab4e-35aef69815f8
type: derived